News for hackers. Stuff that matters.
Re:Peppering (Password Storage) by linsomniac on Thursday July 02, 2020 @11:05AM (#23713997)
The article explains why you want a 2-way function: it allows you to rotate the pepper. If you have a one-way pepper, you can't change the pepper if it were to be exposed.

The whole idea is to have a factor that is never stored in the database, so a database dump cannot expose hashes that can be attacked. Just as the user may want to change their password periodically, the site operator might want to change their pepper. Without a 2-way function, you can't do that without the user presenting their unencrypted password again.

Re:Peppering (Password Storage) by stouset on Thursday July 02, 2020 @11:46AM (#23714556)
That’s fair. You can always HMAC a second time to rotate the pepper, however.