Is this a valid password storage technique?
After watching multiple videos on methods of attacking stored password hashes, I had an idea of how to protect against it. But I wanted to ask people who know true cryptography.
Here is the process I was thinking: Plain text -> SHA256 -> Pseudo Random Operation using the SHA256 Hash as the seed -> SHA256.
By placing that deterministic random step in the middle and rehashing, it prevents any brute force/dictionary attack on the password hashes. The operation doesn't even need to be crytographically safe because it's output is rehashed. To me, this seems safer than a salt, because the salt needs to be stored with the password, where as this is kept in code. The only down side I can think of is it would require more computation than a single hash.
Thoughts?
Posted Apr 26, 2017, 5:40 PM UTC