ECDSA is a completely different beast. I'm not aware of a modern password hashing function that would be broken if it was given a non-uniformly random salt. If

ECDSA is a completely different beast. I'm not aware of a modern password hashing function that would be broken if it was given a non-uniformly random salt. If such function were to be submitted to PHC (https://password-hashing.net/ https://password-hashing.net/), I would consider it to be a disqualifying factor. For password hashing purposes, salt doesn't need to be uniformly random, the only requirement for salt is to be unique and unpredictable to the attacker (see http://crypto.stackexchange.com/questions/6119/hashing-passwords-with-a-salt-why-use-different-salt-for-everyone/6132#6132 http://crypto.stackexchange.com/questions/6119/hashing-passw...). Most password hashing functions use a cryptographic hash on salt. This particular function, scrypt, uses one-round PBKDF2-HMAC-SHA256 to mix password and salt: https://github.com/golang/crypto/blob/master/scrypt/scrypt.go#L236 https://github.com/golang/crypto/blob/master/scrypt/scrypt.g... PBKDF2 feeds salt, basically, into SHA256: https://github.com/golang/crypto/blob/master/pbkdf2/pbkdf2.go#L55 https://github.com/golang/crypto/blob/master/pbkdf2/pbkdf2.g...