3 ms·
NIST may say that you should use "peppers" for passwords, but nobody else does. None of bcrypt, scrypt, or Argon2 use them and are not materially worse for it.
by eropple 8y ago
NIST may say that you should use "peppers" for passwords, but nobody else does.
None of bcrypt, scrypt, or Argon2 use them and are not materially worse for it.
- devy 8y agoYes, adding pepper is a recommendation not a mandatory step. But a lot of sites do, I.E. PagerDuty [1], paired with PBKDF2 as many apps requires to meet FIPS certification or enterprise support on many platforms.[2] [1]: https://sudo.pagerduty.com/for_engineers/ https://sudo.pagerduty.com/for_engineers/ [2]: https://www.owasp.org/index.php/Password_Storage_Cheat_Sheet https://www.owasp.org/index.php/Password_Storage_Cheat_Sheet