I'm using a bcryptjs
to generate a computationally slow hash function for storing passwords:
BCRYPT.hash(plainTextPassword, HASH_ROUNDS_NUM);
Now I want to add a pepper before a hash is calculated:
BCRYPT.hash(pepperedPassword, HASH_ROUNDS_NUM);
where pepperedPassword = plainTextPassword + PEPPER;
Questions:
Should I represent a
PEPPER
as astring
or as abuffer
?To calculate a
pepperedPassword
I can either just concatenate two values:
pepperedPassword = concate(plainTextPassword, PEPPER);
or concatenate them and then calculate a fast hash of it (in addition to bcrypt
):
const concatPassPepp = concate(plainTextPassword, PEPPER);
const hashedConcatPassPepp = crypto.createHash("SHA3-512").update(concatPassPepp, "utf8").digest("base64");
Is it a useful idea to calculate a fast hash of password-pepper concatenation before sending it to bcrypt
? Which scenario should I prefer?
Both questions are asked from security and performance point of view.
bcryptjs
, so no homemade, no new, regarding complexity I'm not sure ifbcrypt(hash(pass+pepper));
can still be considered as keep it simple solution. Should I move the question to OS? $\endgroup$ – Mike B. Sep 28 at 8:53bcryptjs.hash()
generates salt automatically, at least that what's written in documentation: npmjs.com/package/bcryptjs#usage---async (Auto-gen a salt and hash). So, the only thing I need to add — the pepper, which must come from a secret place, e.g. app. configuration file. $\endgroup$ – Mike B. Sep 28 at 9:10