I'm using a
bcryptjs to generate a computationally slow hash function for storing passwords:
Now I want to add a pepper before a hash is calculated:
pepperedPassword = plainTextPassword + PEPPER;
Should I represent a
stringor as a
To calculate a
pepperedPasswordI can either just concatenate two values:
pepperedPassword = concate(plainTextPassword, PEPPER);
or concatenate them and then calculate a fast hash of it (in addition to
const concatPassPepp = concate(plainTextPassword, PEPPER); const hashedConcatPassPepp = crypto.createHash("SHA3-512").update(concatPassPepp, "utf8").digest("base64");
Is it a useful idea to calculate a fast hash of password-pepper concatenation before sending it to
bcrypt? Which scenario should I prefer?
Both questions are asked from security and performance point of view.