From what I understand is that if no salt is defined the first two characters of the entered password become the salt.