News Feed
Jobs Feed
Sections




News Archive
Looking for more information on how to do PHP the right way? Check out PHP: The Right Way

Anthony Ferrara's Blog:
Properly Salting Passwords, The Case Against Pepper
April 18, 2012 @ 09:23:31

In this new post to his blog Anthony Ferrara looks at a common idea that comes up when the discussion of encryption of passwords in PHP - the global salt (or "pepper").

The other day I announced the release of my new password hashing library, PasswordLib. As I've come to expect, Reddit was full of interesting commentary on the topic. Some was good, some was bad and some surprised me. What surprised me was the insistence on a global salt (otherwise known as a "pepper"). So, I started thinking about it some more, and I figured I'd write a post on why I don't use peppers in my hashing algorithms (and why you may want to rethink it too).

He starts with an explanation of what a salt is (and isn't) to lead naturally into the idea of a "pepper", a single unique value that's used across an entire site/application for password encryption. He covers four flaws inherent with this method:

  • There's no proof that using them increases your security.
  • There are no publicly vetted hashing algorithms that accept a pepper as an argument.
  • Using a block cipher instead of a pepper provides a stronger level of encryption and protection.
  • The entire concept of a pepper is based around a flawed premise. [...] The flaw in that premise is that it's often not just your database that's leaked.
0 comments voice your opinion now!
password encryption salt pepper cipher


blog comments powered by Disqus

Similar Posts

IBM developerWorks: Cook up Web sites fast w/CakePHP, Part 1: Adding related information & services

PHPEasyStep.com: Sending forgotten password

Kavoir.com: Just Hashing is Far from Enough for Storing Passwords (Dictionary & Rainbow Attacks)

Reddit.com: Login Security (Best Practices Recommendations)

ITNewb.com: Encrypting Passwords with PHP for Storage Using the RSA PBKDF2 Standard


Community Events











Don't see your event here?
Let us know!


performance language symfony2 introduction release framework application example facebook package database hhvm podcast install security hack project composer unittest component

All content copyright, 2014 PHPDeveloper.org :: info@phpdeveloper.org - Powered by the Solar PHP Framework