Hacker News Reader

Comment by typedweb | Hacker News Reader

The pepper is the key to the encryption, not a hashing algorithm.

Thanks for just ignoring my question - THERE IS NO ENCRYPTION IN THE ORIGINAL ARTICLE, so WHY are you restating that encryption is involved at all?

Straight from the original artical:

  hashed_password = scrypt(password, salt + pepper)

  hashed_password = scrypt(scrypt(password, salt),pepper)

Absolutely zero encryption going on here. Therefore, no ability to "decrypt" the pepper result. The pepper IS NOT a key for encryption. Period.