A "pepper" is sometimes mentioned – an application-specific secret key. The canonical answer on password hashing implies that a adding pepper brings the composition close to a MAC, and that cryptographic MAC function should be used rather than concatenating a pepper together with the salt and password.
My question is: Where applicable, what would be a generally recommendable, sound, well understood way to MAC a user password and a secret key, in the context of password hashing?
I want to MAC the password using a secret key, then feed the output of the MAC to a slow hash function (like bcrypt, scrypt, or PBKDF2). I want to know what kind of MAC to use. To represent the MAC, I'm using this notation
- HMAC-SHA256secretkey(message) and HKDFsalt(password)
passwordis the low-entropy user password
keyis the high entropy secret key (the "pepper")
saltis a per-password random value, optionally reused by the subsequent computationally expensive hash such as bcrypt, PBKDF2, or scrypt
Would any of these constructs be more recommendable? Or is there an even better way? And if so, briefly why?
- HMAC-SHA256 key(password)
NB: This question is in relation to the "pepper" section near the end of the accepted answer to "How to securely hash passwords". Thus the output of the MAC will be fed to a slow, computationally expensive KDF like bcrypt, PBKDF2, or scrypt.