Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

> bcrypt(password, salt+pepper)

I hope it's obvious that no one should never do this, since the output would contain the "salt+pepper" bits in cleartext alongside the hash, defeating the entire point of the "pepper":

https://www.usenix.org/legacy/event/usenix99/provos/provos_h...

In fact, this is a perfect illustration of why it's bad to put secret bits into a crypto function in a place that's not designed to take secret bits. Bcrypt does not treat the salt parameter as a cryptographic secret, and other algorithms might not either. And they might leak it in more subtle ways.



One would think it's obvious, yet this is what the person in the linked article suggests doing :/




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: