How does the "authentication unique keys and salts" feature work?

Question

I'm trying to find some information on how the authentication keys and salts work in WordPress, but unfortunately I wasn't able to find anything useful. All I got is that the keys should be random, long and different from each other. They should be set in the wp-config.php file because they "greatly increase site's security" by "ensuring better encryption of information stored in the user's cookies".

I actually have some questions, not just one, but I think they should be in one thread because they're closely related.

1. What does the "better encryption of information" mean exactly? I mean in contrast to the situation without the keys.

2. Why do I need 8 keys, and not just one? Judging by the names -- AUTH, SECURE_AUTH, LOGGED_IN, NONCE -- they should set four cookies. One and two for authentication via http and https protocols respectively, three for being logged and 4... I have no idea what that would be for.

3. Why do I need keys and salts? Wouldn't that work just for keys? They pretty long and random, so what is the purpose of additional salts in this case?

4. I've read another question (I don't remember exactly where that was) and there was info that if you delete the keys and salts from wp-config.php file, they will be stored in the WordPress database under wp_options table. And that's true, I've tested that, the keys were created and put into the table. But what would happen when I restored the (different) keys in the wp-config.php file? Will the two keys from the wp-config.php file and the database be combined into one, as the question suggested, or just one of them will be used, if so, which one?

5. What actually happens when a user visits my blog? He has an account, see the main page and log into the system, and what's next? I mean what happens with the keys, cookies (and everything else) in this time? What is the exact process of logging into a WordPress website?

6. What is the best size of the keys? The default one is 64 characters. Is there any limit here?

7. Can I put whatever character in the keys (of course, without ')? Can I use foreign language characters, for instance, ó or Ż? What about © and others?

Answer 1

1. Basically, they're hashing salts. They're used to make the results of hashing much less predictable. See https://en.wikipedia.org/wiki/Salt_(cryptography) for info on salts.

2. AUTH is used for the /wp-admin authentication cookie, SECURE_AUTH is for the same when using SSL, LOGGED_IN is used for identification to the "front-end" of the site. NONCE is used for the nonces that WordPress generates to guard against CSRF attacks.

3. The KEY and SALT for each scheme are combined to make the actual salt used. The wp_salt function checks for duplicated strings here to ensure that they are not the same, and to generate random strings if they are.

4. WordPress preferentially uses the values in the wp-config.php file. If they are not available or are duplicates of one another, random data is generated and stored in the database. But the values defined in the wp-config.php take precedence.

5. When you login, the password is validated. After that, the cookies are generated. These cookies contain various bits of information that will authenticate you to the site for future visits. The value in the cookie changes based on many factors, including the expiration time, your user name, your password, etc. Basically, the cookie is a username and password all in one. This data is hashed using the auth keys and salts. On future visits, the cookie is sent with the request, and WordPress validates the information it contains. This proves that you are you and so you're logged in. The value in the cookie is secure because it cannot be generated without knowing the various salts as well as all the other pieces of information.

6. Their size is really irrelevant. They should be long and random. There is no limit, but there is a point of diminishing returns. Longer is better but takes more time to hash. After around 120 characters or so, it's kind of overkill.

7. Yes. You can use any data you like. It does not matter what it is, as long as it's really random. Any binary string will do. Line noise.