Questions tagged [pepper]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
2
votes
2answers
636 views

Appending a secret (pepper) to Argon2 password hashes

I've read quite a bit of the StackExchange and HackerNews debates on the user of "peppers" in password hash security. There are a number of different implementations of the idea of a pepper, ranging ...
2
votes
1answer
205 views

Does the use of pepper for passwords violate Kerckhoffs's principle? ​

Kerckhoffs's second principle: "It should not require secrecy, and it should not be a problem if it falls into enemy hands." Does the use of a pepper for passwords violate this principle, since ...
3
votes
3answers
413 views

How is a pepper used with salted passwords?

How is a pepper (a large constant number) used after a password has been salted with a salt by a hashing function such as bcrypt? From Sybex CISSP Official Study Guide, 8th Edition (2018): Adding ...
0
votes
1answer
72 views

Is a constant pepper at risk if an attacker knows the value and hash?

My app is a educational game for elementary schools, involving no money or anything of value, so I am not worried about sophisticated attackers having any interest in this. Still, I would like to ...
4
votes
3answers
879 views

How to securely hash/tokenize a string

A system I'm working on accepts as input a customer account number and needs to generate a token based on it. We're not allowed to store the plain text of the account number itself, so the goal of the ...
5
votes
2answers
643 views

Hashed passwords storage: iterations vs entropy [duplicate]

Context: A website is hosted on multiple dedicated servers. There are frontend webservers, backend DB servers and other servers between them. The DB holds user's accounts passwords. All connections ...