Btukfyl

I've a question regarding the suggestion on the 2 top answers on this question.

On the last part of their answers, they're saying it's better to encrypt the password hash than using hardcoded pepper for maintainability (in case your hashes leak, you can rotate the keys).

Is this the pseudo-code of what they're saying?

$key = 'random_key_stored_elsewhere';

$hash = bcrypt($password);

$encrypted = encrypt($hash, $key);

// store $encrypted to DB

Now to check a login attempt:

if (bcrypt($user_input) == decrypt($encrypted, $key))

{

    // proceed login...

}

Say hash leaked, now we need to change the key and re-encrypt the hashes:

$decrypted_data = decrypt($encrypted, $key)

$new_key = 'new_random_key_stored_elsewhere';

$encrypted = encrypt($decrypted_data, $new_key);

// store $encrypted to DB

Is that it? If yes, then how can rotating the keys in case of a hash leak invalidate the would-be cracked passwords if the same procedure is used for checking login attempts? E.g.,

if (bcrypt($user_input) == decrypt($encrypted, $new_key))

{

    // proceed login...

}

Rotating the keys would've been useless right or am I missing something?

You are assuming that when the key is lost, the password-hashes are lost as well, which is indeed often the case. In this situation there is no protection, whether you encrypted the password-hashes or used a pepper.

There are other scenarios as well though. Maybe your source code leaked, somebody accidentally checked in the key in the version control system, or a developer machine has a backdoor. As soon as you dicsover such a leak, you can exchange the key on the server, before the database containing the hashes is attacked. With a pepper you had to reset all passwords instead and inform the users about it.

Maybe an attacker got the password-hashes (SQL-injection, backup) and now tries to attack your server to get the key. If you discover it in time, you can exchange the key and the leaked hashes are worthless. You gain the time between the leak of the passwords and the leak of the key to react.

BTW your description is nearly correct, to verify the password you have to decrypt the hash first, then you can verify it with BCrypt (it is not possible to compare it).

if (bcrypt_verify($user_input, decrypt($encrypted, $key)))