4 ms·
Excuse my ignorance, but you probably shouldn't be able to reverse an irreversible hash.
by JimmaDaRustla 12y ago
Excuse my ignorance, but you probably shouldn't be able to reverse an irreversible hash.
- typedweb 12y agoIt's reversing the encryption, not the hash.
- JimmaDaRustla 12y agoWhere in the original example was encryption involved? The salt and pepper were only ever used in a hashing algorithm.
- typedweb 12y agoThe pepper is the key to the encryption, not a hashing algorithm.
- JimmaDaRustla 12y agoThanks for just ignoring my question - THERE IS NO ENCRYPTION IN THE ORIGINAL ARTICLE, so WHY are you restating that encryption is involved at all? Straight from the original artical: hashed_password = scrypt(password, salt + pepper) or hashed_password = scrypt(scrypt(password, salt),pepper) Absolutely zero encryption going on here. Therefore, no ability to "decrypt" the pepper result. The pepper IS NOT a key for encryption. Period.
- spullara 12y agoThe pepper is being used as an encryption key in that example rather than using hashing.
- JimmaDaRustla 12y agoIn pacofvf's example, you are correct. But, the original example is hashing the password. No encryption involved. So what makes anyone think that they can reverse a hash?
- richardlblair 12y agoThe problem is that pacofvf's answer assumes you don't need to do this retroactively. This would work if you were building a new system today, but if you had a DB full of one way hashes you're not going to be able to retroactively modify the pepper.
- richardlblair 12y agoAnd more importantly, slack straight up stated they salt the password and use bcrypt. It's all one way hashes, no encrypting/decrypting going on.
- worklogin 12y agoThe point of hashing passwords is that the true password is not revealable. The point of salting password hashes is to prevent identical cleartext passwords from being stored as identical hashes in the database. Salts are often stored in the database, as well. The point of peppering keeps a database dump from being at all useful for recovering passwords. It make sure that a component of the process of cleartext -> DB entry is not even in the database, requiring something from the app as well. Why does encryption work here? Because you've already done a one way function on the cleartext -> salted hash. At that point, there is still no way to reverse the process all the way to get the cleartext. By using a two-way encryption function for the pepper portion, you keep the ability to rotate 'peppers' periodically, in case it is leaked, for example.
- ionwake 12y agoThanks for the informative post