n.b. I am not a crypto expert (which is why I'm using a library like NaCl).
From what I have read on the subject, the most secure way to store user passwords in a database is to store the hash and the salt used to generate that hash. I decided to use libsodium-net for this purpose, but now I'm left with the question in the subject: do I not need to generate and store salts? I ask because libsodium-net includes these functions:
// this uses the default Strength.Interactive hashing algorithm
var hash = PasswordHash.ScryptHashString(password);
var isValid = PasswordHash.ScryptHashStringVerify(hash, password);
There doesn't appear to be a need to use a salt when either generating or verifying the hash. In fact, there are no overloaded methods of ScryptHashString and ScryptHashStringVerify that accept a salt. I feel like I'm missing something obvious here. Am I? Or does libsodium-net obviate the need for salts?