Optimal password salt length

Question

Possible Duplicate:
What is the optimal length for user password salt?

I tried to find the answer to this question on Stack Overflow without any success.

Let's say I store passwords using SHA-1 hash (so it's 160 bits) and let's assume that SHA-1 is enough for my application. How long should be the salt used to generated password's hash?

The only answer I found was that there's no point in making it longer than the hash itself (160 bits in this case) which sounds logical, but should I make it that long? E.g. Ubuntu uses 8-byte salt with SHA-512 (I guess), so would 8 bytes be enough for SHA-1 too or maybe it would be too much?

Answer 1

Current standards suggest a 16 char-length salt http://en.wikipedia.org/wiki/Crypt_%28Unix%29#SHA-based_scheme

Also this question has been asked before :)

Answer 2

In my opinion, the biggest worry with hashed passwords are rainbow tables. There are rainbow tables available that hold values as high as 64 characters last I checked. Keeping this in mind, you would probably want your hashed value to be somewhere greater than that to avoid being easily "looked up" in a rainbow table. This means that the salt+password length should be greater than 64.