title: Encryption: How to turn an 8 character string into a 128-bit key, 256-bit key, etc?
body: <p>I tried to research this, but there were still some questions left unanswered. I was looking into figuring out how an 8 character password gets turned into a high-bit encryption key. During my research I found articles that would talk about the salt value.</p>
  
  <p>Assume you could get all 256 characters to play with, then an 8-character password would be 64-bits long. So, the remaining 64 bits is simply a salt value. And, correct me if I'm wrong, but this is done so that if someone was going to try to try <strong>ALL</strong> the possible values (brute force) they'd have to try all 128-bits since even the salt is unknown.</p>
  
  <p>My questions really relate to this 'salt' value:</p>
  
  <ol>
  <li>When someone makes an application, is the salt value hard-coded into it? And if so, can't it be obtained through reverse engineering the executable?</li>
  <li>If the salt is generated at random, then I assume it must have some way to duplicate it. So, isn't that function that returns a random salt able to be reverse engineered to force it to duplicate itself to get the salt value?</li>
  <li>This might be out of the scope, but if a salt value is generated on a server side (of a client/server relation), then wouldn't it have to be shared with the client so they can decrypt data sent by the server? And, if it's being sent over to the client, can't it be intercepted which makes it useless?</li>
  <li>Is there some other method that is used besides this 'salt' value that can turn an 8-character string into a strong encryption key?</li>
  </ol>