2023-03-14 Share on: Twitter | Facebook | HackerNews | Reddit

Salt and Pepper in the Context of Hashing/Obfuscation

In the context of hashing/obfuscation, "salt and pepper" refer to two different techniques used to enhance the security of hash functions.

Salt

Salt is a random value that is added to the input before it is hashed. This makes it much more difficult for attackers to use precomputed hash tables or rainbow tables to attack the hash. By using a unique salt for each input, even if two inputs have the same value, their hashes will be different, making it much harder for attackers to determine the original input value.

import hashlib
import os

def hash_with_salt(password):
    # Generate a random salt
    salt = os.urandom(16)
    # Add the salt to the password and hash it using SHA256
    hashed_password = hashlib.sha256(salt + password.encode('utf-8')).hexdigest()
    # Return the salt and hashed password as a tuple
    return (salt, hashed_password)

# Example usage
password = "mysecurepassword"
salt, hashed_password = hash_with_salt(password)
print(f"Salt: {salt}")
print(f"Hashed Password: {hashed_password}")

Pepper

Pepper, on the other hand, is a secret key that is used to further obscure the hash output. Unlike a salt, which is stored alongside the hash, the pepper is kept secret and never stored. This makes it much harder for attackers to reverse-engineer the original input value from the hash output.

import hmac
import hashlib

def hash_with_pepper(password, pepper):
    # Hash the password using HMAC-SHA256 with the secret pepper
    hashed_password = hmac.new(pepper.encode('utf-8'), password.encode('utf-8'), hashlib.sha256).hexdigest()
    # Return the hashed password
    return hashed_password

# Example usage
password = "mysecurepassword"
pepper = "mysecretpepper"
hashed_password = hash_with_pepper(password, pepper)
print(f"Hashed Password: {hashed_password}")

Using salt and pepper jointly

import hashlib
import hmac
import os

def hash_with_salt_and_pepper(password, pepper):
    # Generate a random salt
    salt = os.urandom(16)
    # Add the salt to the password and hash it using SHA256
    hashed_password = hashlib.sha256(salt + password.encode('utf-8')).digest()
    # Hash the hashed password using HMAC-SHA256 with the secret pepper
    hashed_password = hmac.new(pepper.encode('utf-8'), hashed_password, hashlib.sha256).hexdigest()
    # Return the salt and hashed password as a tuple
    return (salt, hashed_password)

# Example usage
password = "mysecurepassword"
pepper = "mysecretpepper"
salt, hashed_password = hash_with_salt_and_pepper(password, pepper)
print(f"Salt: {salt}")
print(f"Hashed Password: {hashed_password}")

Previous Post Next Post