2
$\begingroup$

I understand the pepper concept of adding but not storing a secret and iterating through the set of possible secret values for verifying.

But is pepper also useful when it comes already to the use of key stretching algorithms?

Key stretching is used to make a (possibly) weak secret more robust against brute force attacks by increasing the validation time. The pepper method has the same purpose. Does it make sense to combine this techniques? Following the important security principle keep it simple, I would expect that e.g. stretching a password with PDKDF2 and a higher iteration value is better than combining pepper and PDKDF2. Is this assumption correct or do I miss an important aspect? Thx.

Improve this question
$\endgroup$

1 Answer 1

Reset to default
3
$\begingroup$

A pepper is similar to a salt, but it is kept secret. So while the salt is stored in the DB the pepper is kept elsewhere, for instance in the code that verifies the password hashes.

A pepper can be used anywhere where a salt is present - mainly PBKDFs: password based key derivation functions. It makes somewhat less sense for KBKDF's: key based key derivation functions as the input secret of KBKDF's is already a key and you would expect it to be kept secure as it is.

The pepper is not really a method, it is just an addition to the salt. The salt is still required as the pepper is generally static. That would mean that identical passphrases would generate the same password hash or symmetric key.

The pepper doesn't increase the work factor / iteration count (much) but it does make it impossible for an attacker to perform the calculations while the pepper is not known. Basically the pepper acts as a secret key that is required to perform the calculations.

Stretching the password using an iteration count is a different way of protecting the password. These are two different ways of making a PBKDF more secure; they do not directly influence each other.

Improve this answer
$\endgroup$
2
  • $\begingroup$ Thx for your detailed answer. You wrote that "the pepper is generally static" and in this context I understand all of your explanations. But Wikipedia lists a second method: "The pepper is small and randomly generated for each input... To verify ... the application iterates through ... [all] possible values". This increases the work factor and seems to be in competition with key stretching. Background of my question is client encryption: The system doesn't store any passwords (perhaps see my second salt question for more details). $\endgroup$
    – User01638
    Nov 10, 2017 at 15:06
  • 1
    $\begingroup$ That [dubious] tag behind that statement makes a lot of sense. I've not heard from using a pepper that way, and it would add a random delay to the work factor.... If the resulting secret of PBKDF2 is used as a password hash or as key doesn't make much of a difference; the attack is almost the same, only if the result is a symmetric key then some additional verification (a few blocks of AES decryption, most likely) needs to be performed instead of a direct comparison with a stored hash. $\endgroup$
    – Maarten Bodewes ♦
    Nov 10, 2017 at 15:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.