Re: [HACKERS] SCRAM salt length

On 8/17/17 09:21, Heikki Linnakangas wrote:
> The RFC doesn't say anything about salt 
> length, but the one example in it uses a 16 byte string as the salt. 
> That's more or less equal to the current default of 12 raw bytes, after 
> base64-encoding.

The example is
  S: r=rOprNGfwEbeRWgbNEkqO%hvYDpWUa2RaTCAfuxFIlj)hNlF$k0,     s=W22ZaJ0SNY7soEsUEjb6gQ==,i=4096

That salt is 24 characters and 16 raw bytes.

-- 
Peter Eisentraut              http://www.2ndQuadrant.com/
PostgreSQL Development, 24x7 Support, Remote DBA, Training & Services