Questions tagged [pepper]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
15 votes
1 answer

Is it a good practice to add hard-coded salt to BCrypt passwords?

I am currently learning about cybersecurity and trying to implement it in my next web application. I have been reading some articles about hashing, specifically SHA2 and Blowfish. In this article, it ...
Josep Enric Sendra Serra's user avatar
0 votes
1 answer

Encrypting salted password hash before storing in the database

I have read here and here, that instead of using pepper, it is better to encrypt hashed/salted passwords before storing in the database. Especially with Java, as there's no library for salt/pepper, ...
BUKTOP's user avatar
  • 105
9 votes
1 answer

In-memory pepper

As far as I understand, a problem with the idea of a pepper is that, if it's stored as part of your code, then the hacker can read it if they can access your code. So I was wondering, would it not be ...
rid's user avatar
  • 329
-1 votes
1 answer

Using a Pepper as the index to insert a salt

In this question on this board the author of the selected answer states the following. If you, as an attacker, manage to extract hashes and salts from a database, you probably either find a way to ...
Morgan Brown's user avatar
6 votes
2 answers

Appending a secret (pepper) to Argon2 password hashes

I've read quite a bit of the StackExchange and HackerNews debates on the user of "peppers" in password hash security. There are a number of different implementations of the idea of a pepper, ranging ...
Prime's user avatar
  • 494
2 votes
1 answer

Does the use of pepper for passwords violate Kerckhoffs's principle? ​

Kerckhoffs's second principle: "It should not require secrecy, and it should not be a problem if it falls into enemy hands." Does the use of a pepper for passwords violate this principle, since ...
AleksanderCH's user avatar
4 votes
3 answers

How is a pepper used with salted passwords?

How is a pepper (a large constant number) used after a password has been salted with a salt by a hashing function such as bcrypt? From Sybex CISSP Official Study Guide, 8th Edition (2018): Adding ...
BJ Dela Cruz's user avatar
0 votes
1 answer

Is a constant pepper at risk if an attacker knows the value and hash?

My app is a educational game for elementary schools, involving no money or anything of value, so I am not worried about sophisticated attackers having any interest in this. Still, I would like to ...
Joshua Frank's user avatar
5 votes
3 answers

How to securely hash/tokenize a string

A system I'm working on accepts as input a customer account number and needs to generate a token based on it. We're not allowed to store the plain text of the account number itself, so the goal of the ...
crgwbr's user avatar
  • 103
5 votes
2 answers

Hashed passwords storage: iterations vs entropy [duplicate]

Context: A website is hosted on multiple dedicated servers. There are frontend webservers, backend DB servers and other servers between them. The DB holds user's accounts passwords. All connections ...
HashDoe's user avatar
  • 53