# Does pepper *require* an HMAC?

Assume you are already given a properly-salted, password hash $$X$$ from some slow PBKDF (e.g., like Argon2id).

Now, you want to apply some large (~256-bit) secret "pepper" $$S$$ to it before storing it in the database.

Is there a significant difference between storing it as an $$\text{HMAC}\left(S,X\right)$$ (where $$S$$ is the secret key to the HMAC of $$X$$) versus a "much simpler/basic" $$H\left(S\mathbin\parallel X\right)$$

where $$H$$ is just some SHA-2? (e.g., SHA-256/512)

• I agree with the conclusion, but not with "statically sized" as the sole argument (I get it as: length extension does not apply). It is necessary to invoke that SHA-2 is a good enough hash that $X\mapsto H(S\mathbin\parallel X)$ is a good PRF keyed by $S$ for constant-size $X$. It would be possible to define a weak $H$ such that observing $X\mapsto H(S\mathbin\parallel X)$ leaks $S$, when that would not apply to $\text{HMAC-H}(S,X)$. That is, not using HMAC puts unduly pressure on the hash, and that pressure is not part of its explicit design criteria. HMAC is advisable for unspecified $H$. – fgrieu Apr 14 at 19:34