Saying we have an oracle that an attacker can use as many time as they want. The attacker can send a non-empty
password to this Oracle. The Oracle hashes the password using
sha256(password + pepper), and sends this to the attacker.
The pepper value never changes (it's a bad constant salt).
Is there a way an attacker can guess the pepper? How would the attacker call the Oracle to get that pepper?
Do the same attack applies if the Oracle uses a
hash_hmac('sha256', password, pepper) method instead of simple
sha256(password + pepper)? Do this applies for
sha256(pepper + password) instead of
sha256(password + pepper)?
I've seen the question Is it possible to get the salt if I have the hash and original password? but there, we have one more condition: attacker can get as many
hash; original password couple as they want to recover the constant pepper, so this condition might change a lot?
My guess is that one can do retrieve the pepper, but I'm not sure how it would be done. The process to retrieve it is not that much important, but I want to get a proof that such process exists and is do-able.