I have read here and here, that instead of using pepper, it is better to encrypt hashed/salted passwords before storing in the database. Especially with Java, as there's no library for salt/pepper, but just for salt hashing, and I'm not going to implement my own crypto in any way. Have questions about it:
- Is it true? Will it add security, if db server is on another physical computer, and encryption keys are stored on the app server's fs?
- If so, is it ok to use RSA for hash encryption?
- To check password in this case, is it better to read encrypted password from the DB, decrypt it, and then compare it to the hashed/salted one entered by user, or encrypt entered hashed/salted password and then compare with the encrypted value in the database? In this case, will it be the same as using another hash, as encrypted hash is never decrypted?
A code sample that I use to get hash now:
KeySpec ks = new PBEKeySpec(password, salt, 10, 512); SecretKeyFactory kf = SecretKeyFactory.getInstance("PBKDF2WithHmacSHA512"); SecretKey sk = kf.generateSecret(ks); byte hash = sk.getEncoded();
A code I am going to add:
Cipher cipher=Cipher.getInstance("RSA"); cipher.init(Cipher.ENCRYPT_MODE, privateKey); byte  encryptedHash=cipher.doFinal(hash);