Hashing user password without database to store salt I am building an Android app that will run purely locally on the user's device, no servers. It has a database that I want to encrypt with the user's password, which requires a 64 byte key. I've considered these 2 ways:


Use bcrypt, but that doesn't give me 64 bytes
Use SHA512 which is much faster to brute-force


The problem with both is that I don't have a reliable place to store a random salt. 
The "attack scenario" would be someone pulling the database file off the phone and using a rainbow table to decrypt. 

Should I:


add a static salt anyway?
use bcrypt and just fill the missing bytes with 0s, because it's more important that generating a rainbow table be hard?
use SHA512?
something else entirely?
BTW, rainbow tables are more thing of the past. They were time / space tradeoffs and currently rainbow tables of most plausible sizes can be generated in seconds by serious crackers - that is, they are not useful. Salt is still recommended to hide the fact when two people have the same password - but you are not using hashing for password storage, so unless you store the generated key hash somewhere, salt is not helping (you only have the encrypted database, not a hash of the password). One would need a rainbow table for all possible passwords in some set and all possible databases (within some constraints). Storage requirements would be insane. I wouldn't be worrying for rainbow tables if I understand the setup correctly.