0
$\begingroup$

If I protected the salt or used a pepper (secret salt) and an attacker got access to the database he can't do a rainbow table attack on a targeted user (a famous or important person).

Should I use a pepper (secret salt) ? If yes, then:

  • how to make it unique accros all users or a group of users (not make it global and fixed) ?
  • how to store it safely without hard coding it ?

Or should I protect the salt ? If yes, which is better:

  • store a part of the salt securely ?
  • encrypt the salt itself ? (by this: Isn't the key used for encryption is somehow a pepper ?)
  • derive the salt from a safely stored secret ? (alse: isn't the used secret is somehow a pepper ?)
$\endgroup$
3
  • $\begingroup$ Rainbow tables are prevented even by public salts. $\endgroup$ Jul 28, 2021 at 2:18
  • $\begingroup$ But when the attacker target a specific user, he might generate a rainbow table using the salt he cracked from the database. $\endgroup$ Jul 28, 2021 at 2:48
  • 1
    $\begingroup$ I think you're confused about what rainbow tables are. rsheasby.medium.com/… is a good explanation. $\endgroup$ Jul 28, 2021 at 12:30

1 Answer 1

2
$\begingroup$

Pick peppers the same way you pick cryptographic keys: use your OS's CSPRNG to generate a 16-32 byte (128-256 bit) pepper.

If your system has a Hardware Security Module (HSM) or secure enclave, you can store a single pepper for all users there. Otherwise you have to use a regular file, so set access permissions appropriately.

It's possible to have a pepper per user in some cases. For that, you typically can't use an HSM or secure enclave since you'll have too many entries for it, and also have to store which user goes with which pepper. So it might make things less secure instead of more secure.

Salts are non-secret by definition. Store the salt in the same database as the username and password hash. For all the current secure password hashing functions the salt is part of the password hashing algorithm's output, and so doesn't need a separate database column.

Whatever you do ensure you have a way to backup and restore the pepper(s). It won't be backed up by your database backups, after all! If it's lost your users can't log in. Remember that security is a combination of confidentiality, integrity, and availability, so don't let the pepper become a single point of failure.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.