3 ms·

I've already seen one person in this thread taking "S+P" literally, and suggesting `bcrypt(cost, salt + pepper, password)`, which has a very obvious and critica

I've already seen one person in this thread taking "S+P" literally, and suggesting `bcrypt(cost, salt + pepper, password)`, which has a very obvious and critical problem. Other "peppering" schemes in the comments here also have significant weaknesses. So yes, even a simple idea like this is easy to botch in implementation -- even if the implementation is just a one-line change!

ufo 12y ago
What is the problem? Does bcrypt truncate "salt+pepper"?
- iopq 12y ago
  Because the salt is in the hash! $2a$12$GhvMmNVjRW29ulnudl.LbuAnUtN/LRfe1JsBm1Xu6LE3059z5Tr8m $2a means it's using bcrypt version 2a $12 means 12 rounds GhvMmNVjRW29ulnudl.Lbu is the salt AnUtN/LRfe1JsBm1Xu6LE3059z5Tr8m is the checksum