5 ms·

If it's shared, it's not a salt. The term of art in that case is 'pepper'.

3np 3y ago
First time I hear this interpretation. A shared salt is still a (very poor) salt. A pepper would not be stored alongside the ciphertexts, if at all.
antod 3y ago
Isn't it the other way around? Most salted hash implementations share the salt by embedding it in the hash. It's pepper that isn't shared. After rereading, I suspect by 'shared' you meant 'non unique' rather than 'public'?
- jameshart 3y ago
  Why would ‘shared’ mean ‘public’? And in most password hashing contexts the salt and hash are not ‘public’ either.
michaelcampbell 3y ago
That's backwards. > In cryptography, a pepper is a secret added to an input such as a password during hashing with a cryptographic hash function. This value differs from a salt in that it is not stored alongside a password hash, but rather the pepper is kept separate in some other medium, such as a Hardware Security Module. https://en.wikipedia.org/wiki/Pepper_(cryptography) https://en.wikipedia.org/wiki/Pepper_(cryptography)
- jameshart 3y ago
  Apparently we understand words differently. A salt is a unique random value added to each value when hashing. Obviously, such a salt needs to be stored alongside each value because it’s random and unique. If you don’t store it how could you possibly ever figure out what it is? A pepper is a shared value added to lots of different things before they are hashed. It isn’t unique to each value, so it doesn’t need to be stored alongside them. Although it still needs to be stored somewhere. But hey, you could also store it alongside every value you store. This is a thing sometimes done when you do ‘per user’ pepper, where for example the pepper is itself a a username or something - so your pepper is also in the database alongside the passwords - but that doesn’t make it a salt. If you are using the same piece of data to season multiple things before hashing, you are using ‘pepper’ not ‘salt’.
  - 3np 3y ago
    I think you may be alone in understanding the words "pepper" and "salt" this way.
    - jameshart 3y ago
      Try reading the rest of the Wikipedia article beyond the first paragraph. Particularly the section on ‘shared-secret pepper’ and ‘unique pepper per user’.

3np 3y ago

First time I hear this interpretation. A shared salt is still a (very poor) salt. A pepper would not be stored alongside the ciphertexts, if at all.

antod 3y ago

Isn't it the other way around? Most salted hash implementations share the salt by embedding it in the hash. It's pepper that isn't shared. After rereading, I suspect by 'shared' you meant 'non unique' rather than 'public'?

jameshart 3y ago
Why would ‘shared’ mean ‘public’? And in most password hashing contexts the salt and hash are not ‘public’ either.

michaelcampbell 3y ago

That's backwards. > In cryptography, a pepper is a secret added to an input such as a password during hashing with a cryptographic hash function. This value differs from a salt in that it is not stored alongside a password hash, but rather the pepper is kept separate in some other medium, such as a Hardware Security Module. https://en.wikipedia.org/wiki/Pepper_(cryptography) https://en.wikipedia.org/wiki/Pepper_(cryptography)

jameshart 3y ago
Apparently we understand words differently. A salt is a unique random value added to each value when hashing. Obviously, such a salt needs to be stored alongside each value because it’s random and unique. If you don’t store it how could you possibly ever figure out what it is? A pepper is a shared value added to lots of different things before they are hashed. It isn’t unique to each value, so it doesn’t need to be stored alongside them. Although it still needs to be stored somewhere. But hey, you could also store it alongside every value you store. This is a thing sometimes done when you do ‘per user’ pepper, where for example the pepper is itself a a username or something - so your pepper is also in the database alongside the passwords - but that doesn’t make it a salt. If you are using the same piece of data to season multiple things before hashing, you are using ‘pepper’ not ‘salt’.
- 3np 3y ago
  I think you may be alone in understanding the words "pepper" and "salt" this way.
  - jameshart 3y ago
    Try reading the rest of the Wikipedia article beyond the first paragraph. Particularly the section on ‘shared-secret pepper’ and ‘unique pepper per user’.