If I protected the salt or used a pepper (secret salt) and an attacker got access to the database he can't do a rainbow table attack on a targeted user (a famous or important person).
Should I use a pepper (secret salt) ? If yes, then:
- how to make it unique accros all users or a group of users (not make it global and fixed) ?
- how to store it safely without hard coding it ?
Or should I protect the salt ? If yes, which is better:
- store a part of the salt securely ?
- encrypt the salt itself ? (by this: Isn't the key used for encryption is somehow a pepper ?)
- derive the salt from a safely stored secret ? (alse: isn't the used secret is somehow a pepper ?)