I understand the pepper concept of adding but not storing a secret and iterating through the set of possible secret values for verifying.
But is pepper also useful when it comes already to the use of key stretching algorithms?
Key stretching is used to make a (possibly) weak secret more robust against brute force attacks by increasing the validation time. The pepper method has the same purpose. Does it make sense to combine this techniques? Following the important security principle keep it simple, I would expect that e.g. stretching a password with PDKDF2 and a higher iteration value is better than combining pepper and PDKDF2. Is this assumption correct or do I miss an important aspect? Thx.