Pepper (cryptography)

In cryptography, a pepper is something that is added to another value (for example a password) prior to the value being hashed using a cryptographic hash function. A pepper can be added to a password in addition to a salt value. A pepper performs a similar role to a salt, however whereas a salt is commonly stored alongside the value being hashed, for something to be defined as a pepper, it should meet one of the following criteria that define it a more carefully hidden 'secret' than the salt value:

• The pepper is held separately from the value to be hashed
• The pepper is randomly generated for each value to be hashed (within a limited set of values), and is never stored. When data is tested against a hashed value for a match, this is done by iterating through the set of values valid for the pepper, and each one in turn is added to the data to be tested (usually by suffixing it to the data), before the cryptographic hash function is run on the combined value.

The pepper value adds security to a collection of compromised data because it increases the amount of computations to determine one piece of data.

Example Usage

Here is a simplified example usage of a pepper value for an account creation. This first table has two username, password, and pepper combinations. The password and pepper are not stored.

Username	Password	Pepper Value (1 byte)
user1	password123	2
user2	password123	D

The pepper value is generated at random and is typically within a limited set of values because it isn't stored; the pepper is 1 byte in this example for simplicity. The pepper value is appended to the password value before hashing the entire value. The hashed value is stored.

Username	String to be Hashed	Hashed Value = SHA256(Password + Pepper)
user1	password123+2	D47AC04095F8DD8BB86022D25BCC7927A1340388BE970A5EFB6B0557189E0FA2
user2	password123+D	FAC82EA77E2B5AEFCFD43603EB4FDF9C767CA35582FA93AD5C34F698402A1B5F

When determining if the account has valid credentials, the program will check if the password matches the hashed value stored by iterating through all the possible pepper values and appending them to the entered password one at a time. Using the example above, here is an illustration for how this process would be completed for user1:

Entered Password	Iterating Pepper Value	Hashed Value (Compare to Stored Hashed Value)
password123	0	C3FD469E91E2D442E2B943744DBC18524E5E73CE892B981FC1504883510CDB68
password123	1	15A56BD4DD3C6544077A0FDF63986E3375A758FC21046D623A3163FF7636F1D9
password123	2	D47AC04095F8DD8BB86022D25BCC7927A1340388BE970A5EFB6B0557189E0FA2

Since the pepper value for user1 is 2, the program would stop here; the account has been verified. For user2, the process is very similar except the program would keep iterating until it reached user2's pepper value:

Entered Password:	Iterating Pepper Value:	Hashed Value (Compare to Stored Hashed Value)
password123	0	C3FD469E91E2D442E2B943744DBC18524E5E73CE892B981FC1504883510CDB6
password123	1	15A56BD4DD3C6544077A0FDF63986E3375A758FC21046D623A3163FF7636F1D9
…	…	…
password123	D	FAC82EA77E2B5AEFCFD43603EB4FDF9C767CA35582FA93AD5C34F698402A1B5F

If the attacker is attempting to brute force a password that is stored with a pepper value, the attacker must append every pepper value to the guess in order to get full coverage. This could multiply the amount of hashing per guess quickly, depending on the length of the pepper value. The idea is to increase the amount of time it would take to brute force while still keeping the honest user's time to gain access relatively low.

Example Usage (with Salt)

While this is more secure than just hashing the password, it is usually used in conjunction with the salt value. Here is an example where both are used:

Username	Password	Pepper Value (1 byte)
user1	password123	2
user2	password123	D

Again, the password and pepper value are not stored, but the salt value and hashed value are stored.

Username	Salt Value	String to be Hashed	Hashed Value = SHA256(Password + Salt + Pepper)
user1	E1F53135E559C253	password123+E1F53135E559C253+2	15BEE8286569A488B520A653BF7B4667089DBE8ECCF8643C5F22F3C580F7208F
user2	84B03D034B409D4E	password123+84B03D034B409D4E+D	FCD58D2C4DB5DAE91128EE184B58FA6E1E83D71BFAABE8EE886E6EAA123777A7

See also

• passwd