Questions tagged [pepper]
The pepper tag has no usage guidance.
10
questions
15
votes
1
answer
5k
views
Is it a good practice to add hard-coded salt to BCrypt passwords?
I am currently learning about cybersecurity and trying to implement it in my next web application.
I have been reading some articles about hashing, specifically SHA2 and Blowfish.
In this article, it ...
0
votes
1
answer
754
views
Encrypting salted password hash before storing in the database
I have read here and here, that instead of using pepper, it is better to encrypt hashed/salted passwords before storing in the database. Especially with Java, as there's no library for salt/pepper, ...
- 105
9
votes
1
answer
5k
views
In-memory pepper
As far as I understand, a problem with the idea of a pepper is that, if it's stored as part of your code, then the hacker can read it if they can access your code.
So I was wondering, would it not be ...
- 329
-1
votes
1
answer
115
views
Using a Pepper as the index to insert a salt
In this question on this board the author of the selected answer states the following.
If you, as an attacker, manage to extract hashes and salts from a database, you probably either find a way to ...
6
votes
2
answers
5k
views
Appending a secret (pepper) to Argon2 password hashes
I've read quite a bit of the StackExchange and HackerNews debates on the user of "peppers" in password hash security. There are a number of different implementations of the idea of a pepper, ranging ...
- 494
2
votes
1
answer
333
views
Does the use of pepper for passwords violate Kerckhoffs's principle?
Kerckhoffs's second principle:
"It should not require secrecy, and it should not be a problem if it falls into enemy hands."
Does the use of a pepper for passwords violate this principle, since ...
- 731
4
votes
3
answers
3k
views
How is a pepper used with salted passwords?
How is a pepper (a large constant number) used after a password has been salted with a salt by a hashing function such as bcrypt?
From Sybex CISSP Official Study Guide, 8th Edition (2018):
Adding ...
- 143
0
votes
1
answer
168
views
Is a constant pepper at risk if an attacker knows the value and hash?
My app is a educational game for elementary schools, involving no money or anything of value, so I am not worried about sophisticated attackers having any interest in this. Still, I would like to ...
- 207
5
votes
3
answers
2k
views
How to securely hash/tokenize a string
A system I'm working on accepts as input a customer account number and needs to generate a token based on it. We're not allowed to store the plain text of the account number itself, so the goal of the ...
- 103
5
votes
2
answers
959
views
Hashed passwords storage: iterations vs entropy [duplicate]
Context: A website is hosted on multiple dedicated servers. There are frontend webservers, backend DB servers and other servers between them.
The DB holds user's accounts passwords. All connections ...
- 53