How long should a salt be to make it infeasible to attempt dictionary attacks?

Question

I\'m designing an authentication system that works like the following:

1. User enters password
2. Salt is generated.
3. Password is hashed with whirlpool<

Answer 1

8 Bytes are sufficent.

When you look in Linux (kernel version 3.16) in /etc/shadow, where the passwords of the user are saved, you can see a form like this:

$id$salt$encrypted_password

• id defines the hash algorithm

In my Linux-Version the salt is 8 digits so 8 bytes and i think the kernel developers know what they do, so i also use 8 Bytes for my salt, which comes from a Cryptographically Secure Pseudo Random Generator source. In Linux you can simply read /dev/random (which blocks when entropy is low) or /dev/urandom (which doesn't block).

For more information read the manpages for crypt.