I recently found this site, proposing a hashing algorithm for passwords.

They describe the following:

  1. pad the password on both sides with SHA1(email) to 4 * length(password)
  2. HMAC(padded password, global salt)
  3. choose a random salt of 22 characters
  4. bcrypt(hmac, salt)

Is this algorithm secure? I think it might be a security flaw to pad the password on both sides with the same text, and I see no point in using a global salt and a salt which is chosen randomly for every password.


Points 3 and 4 are a secure way of storing the input to bcrypt (with appropriate choice of parameters for bcrypt).

Points 1 and 2 aren't necessary but don't harm:

  • they would add a small amount of extra computation for an attacker is possession of the password database that wants to do a dictionary attack;
  • the attacker wouldn't be able to straight-out use a standard cracking tool as it is a custom scheme, they would need to modify existing tools or develop their own.
| improve this answer | |
  • $\begingroup$ so it doesn't matter that the sha1(email) is used on both sides of the password? $\endgroup$ – pascalhein May 19 '13 at 8:16
  • $\begingroup$ That's right; provided the password is there in full in the input to HMAC (if HMAC is being used with a standard hash algorithm), adding additional entropy-less data doesn't lower the entropy of the output. $\endgroup$ – Michael May 19 '13 at 8:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.