How to restrict the length of the encryption and salt?

Question

I'm currently using the SimpleEncrypto NuGet package to encrypt my passwords, like so:

var crypto = new SimpleCrypto.PBKDF2();
var encrypPass = crypto.Compute(user.Password);
var newUser = db.Users.Create();
newUser.PasswordSalt = crypto.Salt;

The trouble is the password and salt generated are about 100 characters, and I'm really just looking to keep it a lot shorter so it'll fit into a table in database. The user is only allowed to enter 20 characters max.

How to restrict the length of the encryption and salt?

Answer 1

First, you are not encrypting but hashing. You can truncate hashes to any length you like. Of course, you risk more collisions the more you truncate the hash.

Just truncate the hash to 20 characters. 20 base64 characters should be enough strength for a password. That's 6*20=120 bits of entropy which is probably more than the password of almost all users has.