When studying Dan Boneh's slides for 'Session Management and User Authentication' (2011) he mentions 'secret salts' on the slide 'Further defences' (slide 48 out of 58).
He suggest to store in the datbase:
Alice|SA|H(pwA , SA , rA)
Alice is the username,
SA the salt associated with Alice and
H(pwA , SA , rA) the result of hashing Alice's password
pwA together with the salt and a small random value
I don't understand why adding a short random value
r (8 bits) slows the verification down by a factor of 128 while an attacker is slowed by a factor of 256.