Re:We didn't encrypt your password, we hashed it
by afiori on Saturday September 05, 2020 @03:30PM
(#24386257)
I always wondered something: does using a secret key as salt and keeping the last (few) block(s) of a block cipher as output produce a reasonable hashing algorithm? maybe with three salts, one for the key, one as a prefix to the password and one as a suffix?
Re:We didn't encrypt your password, we hashed it
by couchand on Friday September 04, 2020 @11:31PM
(#24381219)
What the GP describes is absolutely correct. It may not be all that common but it is a known pattern. That you haven't heard of it doesn't mean it doesn't exist.
> An alternative approach is to hash the passwords as usual and then encrypt the hashes with a symmetrical encryption key before storing them in the database, with the key acting as the pepper.
https://cheatsheetseries.owasp.org/cheatsheets/Password_Stor...
And no, pepper is not encryption. Encryption is reversible, you can decrypt the ciphertext with the key.
Hashing isn't encryption / Confidentiality isn't integrity / RAID isn't backup / Income isn't profit
Not knowing the difference doesn't mean there isn't a difference.