3 ms·
If you encrypt instead of peppering, you just decrypt then re-encrypt with a new key and call it a day. Peppering has always meant, to me, doing something like
by CiPHPerCoder 10y ago
If you encrypt instead of peppering, you just decrypt then re-encrypt with a new key and call it a day.
Peppering has always meant, to me, doing something like this:
// Hashing
$preHash = base64_encode(
hash_hmac('sha512', $password, $_ENV['pepper'], true)
);
$storedHash = password_hash($preHash, PASSWORD_DEFAULT);
// Validation
$preHash = base64_encode(
hash_hmac('sha512', $password, $_ENV['pepper'], true)
);
if (password_verify($preHash, $storedHash)) {
// You're in!
}
To anyone reading this: Don't bother peppering.
- jbrownbridge 10y agoAlternatively you could just encrypt the already encrypted data with the new key.
- CiPHPerCoder 10y agoWouldn't that require you to retain all compromised keys, and daisy chain the encryption operations?