Password Hashing add salt + pepper or is salt enough?
I'm new to security and trying to understand why encrypting or hiding a salt is not considered useful. I've read the earlier post http://stackoverflow.com/questions/213380/the-necessity-of-hiding-the-salt-for-a-hash on why hiding or encrypting salt is unnecessary but the answer was based off the assumption
If someone has access to your database, then they have access to the encrypted salts, and they probably have access to your code as well
Just because an attacker has access to your database why should we assume he has access to the code interacting with it? For example, you have your salted passwords on a MySQL server on one machine along with the encrypted salts. And you have the key for decrypting the salts or some intricate encryption/decryption logic on a web server on a separate machine. An attacker gains access to the database via SQL injection or some other means. Hasn't the encryption and distributed architecture saved the day here?