# Add a pepper to a hash: as a string or a buffer, and should I calculate a hash of a peppered plain text?

I'm using a bcryptjs to generate a computationally slow hash function for storing passwords:

BCRYPT.hash(plainTextPassword, HASH_ROUNDS_NUM);


Now I want to add a pepper before a hash is calculated:

BCRYPT.hash(pepperedPassword, HASH_ROUNDS_NUM);


where pepperedPassword = plainTextPassword + PEPPER;

Questions:

1. Should I represent a PEPPER as a string or as a buffer?

2. To calculate a pepperedPassword I can either just concatenate two values:

pepperedPassword = concate(plainTextPassword, PEPPER);


or concatenate them and then calculate a fast hash of it (in addition to bcrypt):

const concatPassPepp = concate(plainTextPassword, PEPPER);

const hashedConcatPassPepp  = crypto.createHash("SHA3-512").update(concatPassPepp, "utf8").digest("base64");


Is it a useful idea to calculate a fast hash of password-pepper concatenation before sending it to bcrypt? Which scenario should I prefer?

Both questions are asked from security and performance point of view.

• @kelalaka, I'm using bcryptjs , so no homemade, no new, regarding complexity I'm not sure if bcrypt(hash(pass+pepper)); can still be considered as keep it simple solution. Should I move the question to OS? – Mike B. Sep 28 '19 at 8:53
• @kelalaka, the point of salt — to fight the repeating hashes due to pass entropy and, as a result, to protect against dictionary attack. The point of pepper — additional protection based on a «not put all eggs one basket» principle, do not store everything required for a hashing in on place, in a DB. Please fix me, if I'm getting wrong. – Mike B. Sep 28 '19 at 8:58
• @kelalaka, regarding "You used pepper instead of salt", as far as i understand, bcryptjs.hash() generates salt automatically, at least that what's written in documentation: npmjs.com/package/bcryptjs#usage---async (Auto-gen a salt and hash). So, the only thing I need to add — the pepper, which must come from a secret place, e.g. app. configuration file. – Mike B. Sep 28 '19 at 9:10
• Sorry, I've miss read. Here a question from Information Security and it is very similar to yours. – kelalaka Sep 28 '19 at 9:18

• Thanks for the detailed explanation. Regarding "it's obvious not to use a string", what is the problem to send a plain string to a hash function, e.g. crypto.createHash(ALG_HASH).update(data, ENC_IN).digest(ENC_OUT)? Should I always send a data to update() as Buffer? Does it give a performance boost? – Mike B. Sep 28 '19 at 10:13