-
Basically, they’re hashing salts. They’re used to make the results of hashing much less predictable. See https://en.wikipedia.org/wiki/Salt_(cryptography) for info on salts.
-
AUTH is used for the /wp-admin authentication cookie, SECURE_AUTH is for the same when using SSL, LOGGED_IN is used for identification to the “front-end” of the site. NONCE is used for the nonces that WordPress generates to guard against CSRF attacks.
-
The KEY and SALT for each scheme are combined to make the actual salt used. The wp_salt function checks for duplicated strings here to ensure that they are not the same, and to generate random strings if they are.
-
WordPress preferentially uses the values in the wp-config.php file. If they are not available or are duplicates of one another, random data is generated and stored in the database. But the values defined in the wp-config.php take precedence.
-
When you login, the password is validated. After that, the cookies are generated. These cookies contain various bits of information that will authenticate you to the site for future visits. The value in the cookie changes based on many factors, including the expiration time, your user name, your password, etc. Basically, the cookie is a username and password all in one. This data is hashed using the auth keys and salts. On future visits, the cookie is sent with the request, and WordPress validates the information it contains. This proves that you are you and so you’re logged in. The value in the cookie is secure because it cannot be generated without knowing the various salts as well as all the other pieces of information.
-
Their size is really irrelevant. They should be long and random. There is no limit, but there is a point of diminishing returns. Longer is better but takes more time to hash. After around 120 characters or so, it’s kind of overkill.
-
Yes. You can use any data you like. It does not matter what it is, as long as it’s really random. Any binary string will do. Line noise.
