Cryptographic Salt, Pepper, and Nonce: Definitions, entropy rules, and preventing Rainbow Tables.

Distinguishing Salt, Pepper, and Nonce

Confusing these three cryptographic components is a frequent source of implementation flaws in authentication systems.

+-----------+-----------------------+-----------------------+-----------------------+
| Attribute | Salt                  | Pepper                | Nonce                 |
+-----------+-----------------------+-----------------------+-----------------------+
| Purpose   | Defeats Rainbow Tables| Defeats DB Breaches   | Defeats Replay Attacks|
| Stored    | Stored in DB alongside| Stored in Secure KMS  | Transmitted in Header |
|           | the password hash.    | or HSM (NOT in DB!).  | or message payload.   |
| Value     | Unique per user.      | Application-wide or   | Unique per single     |
|           | (At least 16 bytes).  | per-tenant secret key.| transaction or call.  |
+-----------+-----------------------+-----------------------+-----------------------+

1. Salt (Unique per user)

If two users choose the password password123, an unsalted hash produces identical strings in the database. Attackers pre-compute trillions of common hashes into lookup tables (Rainbow Tables). A unique 16-byte random salt guarantees that identical passwords produce completely different hash strings.

2. Pepper (Secret key outside database)

A secret cryptographic key applied to the password before hashing. If an attacker dumps the SQL database via an SQL injection flaw, they still cannot crack the hashes because they lack the pepper stored inside AWS KMS.

3. Nonce (Number Used Once)

An arbitrary number that must never be reused with the same key. Used in AES-GCM encryption (initialization vector) and CSP Nonces to prevent replay attacks and ensure unique ciphertexts.