Is adding encryption before hashing more secure?

Question

One way to secure a password in the database is to hash it with salt i.e. appending a random string to the password and then hash it and store the value.

Does encrypting the password || salt then hashing it make it more secure? Is it really necessary (or can I skip the encryption part)?

"Is it necessary?" Since it is your own invention and not the standard process, you can safely conclude that it is not *necessary*. — schroeder, Sep 08 '20 at 15:28
@schroeder but hashing itself is non-reversible. Just thinking if I encrypt the pw before hashing it will further reduce the use of a e.g. rainbow table? — xcoder, Sep 08 '20 at 15:29
No, it will not reduce the effectiveness of the rainbow table — schroeder, Sep 08 '20 at 15:30
Salts defeat the rainbow table. You've just added a small extra step. — schroeder, Sep 08 '20 at 15:32
This is a [pepper](https://en.wikipedia.org/wiki/Pepper_(cryptography)) — paj28, Sep 08 '20 at 16:42

schroeder · Accepted Answer · 2020-09-08T15:35:09.410

2

The general idea is that any secure process must be able to remain secure even if the process is known. In this scheme, you've just added a step: encryption.

But you have to accept that people will know that you've added encryption and what type. This means that you've only made the process of checking passwords just one step more difficult because there is that extra step.

This means that you've only made it a little more difficult to test passwords: hash(encrypt(password||salt))

Your better bet is to do what is suggested for best practice: multiple rounds of hashing.

edited Sep 08 '20 at 15:35

answered Sep 08 '20 at 15:32

schroeder

125,553
55
289
326

ok...so I assume my key is also stolen, so the encryption becomes a joke? – xcoder Sep 08 '20 at 15:33
If they can steal the password table, then you have to assume they can also get the key. – schroeder Sep 08 '20 at 15:34

score 1 · Answer 2 · answered Sep 08 '20 at 15:28

1

Provided a proper password hashing is used, hashing and salting alone is sufficiently secure. Additional encryption does not add any relevant security to it.

answered Sep 08 '20 at 15:28

Steffen Ullrich

190,458
29
381
434

Is adding encryption before hashing more secure?

2 Answers2