Hacker News Reader

Comment by A_No_Name_Mouse | Hacker News Reader

Is there any advantage in using this method over HMAC with the key stored in the HSM, without pepper or salt? It seems overly complex to me but I'm not a cryptographer.

View on HN

The main benefit of peppering is that if your password hashes are compromised (read: stolen) ... they can't be brute-forced. Password hashes such as argon2 make brute-force cracking more expensive, but nothing can help you all that much if the password is "letmein" or something quite high up on the guess list. With well implemented pepper there's just no way to even check one password, never mind brute-forcing.

If you go beyond peppering and also use encryption to protect the whole password database you can get additional benefits like keeping the list of usernames secret.

Only assuming the attacker doesn't get the "pepper". Since the password hashes should be kept securely, if you've got a way to keep the attacker from getting to the pepper you should just store the hashes there instead.

It can be useful as a "defense in depth" thing, but it's not a particularly meaningful improvement to practical security.

In general, the benefit of encryption is 1/ defense in depth by requiring an additional secret and 2/ the reduced size of that secret you have to protect. E.g. you can protect a 2GB top secret data trove with a 128-bit AES key. The same applies here, and it can be cheaper/easier/more-effective to lock an encryption key away in an enclave than the whole thing.

Except that they're talking about per-user pepper, so 16 bytes per user, in addition to the hash & salt. It's not a sensible tradeoff.

Reply on news.ycombinator.com