Thread: Password hashing & Salts

Hey guys! So, after a longer time than it should have taken, something clicked in my tiny little brain and I understood salts. Now, my question: are LARGE salts a bad idea? I don't see much difference between a 16 byte salt and a 1024 byte one... would it help? Would it be negative? Is there a sweet spot for salt length? Also, about peppers... (if you dont know, basically you create a 1 byte "salt" and DONT store it to your DB/datastore/whatever. When logging in, you must try all 256 different bytes. This is still fast for users logging in, but makes it take 256 times as much time to crack.) are they a bad idea? They seem like a great idea to me... and I don't mind my login process being 256 times slower. I also don't care if it takes a whole minute, which it doesn't. I do however, want my hashes to be as secure as possible. Obviously, I'm using a SecureRandom. What about using multiple hashes? i.e. Hash(Hash(Hash(pepper + salt + password)))? Is it a good idea or a bad idea? I mean, it seems like a good idea to me but i'm not a cryptographer. Also, right now I am using SHA-1. What algorithm should I use? I have heard that scrypt is the "most secure", but i'm not sure.

Either way, what I have now is certainly more secure than just a SHA-1.
Thanks for reading, hope you guys can clear these things up for me.

By the way, I wasn't really sure where the best place to post this was so.. sorry if this isn't the right spot.