Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I recently found this site, proposing a hashing algorithm for passwords.

They describe the following:

  1. pad the password on both sides with SHA1(email) to 4 * length(password)
  2. HMAC(padded password, global salt)
  3. choose a random salt of 22 characters
  4. bcrypt(hmac, salt)

Is this algorithm secure? I think it might be a security flaw to pad the password on both sides with the same text, and I see no point in using a global salt and a salt which is chosen randomly for every password.

share|improve this question
up vote 5 down vote accepted

Points 3 and 4 are a secure way of storing the input to bcrypt (with appropriate choice of parameters for bcrypt).

Points 1 and 2 aren't necessary but don't harm:

  • they would add a small amount of extra computation for an attacker is possession of the password database that wants to do a dictionary attack;
  • the attacker wouldn't be able to straight-out use a standard cracking tool as it is a custom scheme, they would need to modify existing tools or develop their own.
share|improve this answer
so it doesn't matter that the sha1(email) is used on both sides of the password? – pascalhein May 19 '13 at 8:16
That's right; provided the password is there in full in the input to HMAC (if HMAC is being used with a standard hash algorithm), adding additional entropy-less data doesn't lower the entropy of the output. – Michael May 19 '13 at 8:28

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.