Security Analysis and Threat Modeling

Peppering defends against specific threat models while providing limited benefit against others. Database breaches represent the primary threat that peppers address. Attackers obtaining database dumps cannot crack passwords without the pepper, even weak ones. This protection extends to backup theft, SQL injection exfiltration, and insider database access. The pepper acts as a cryptographic barrier between database compromise and password exposure.

However, peppers provide no protection against online attacks, phishing, malware on user devices, or application-level compromise that reveals the pepper. If attackers gain code execution or access to application memory, they can extract the pepper and reduce security to standard salted hashing. This limitation means peppers supplement rather than replace other security measures.

def threat_model_analysis():
    """Analyze security benefits and limitations of peppering"""
    
    print("Pepper Security Analysis\n")
    
    print("✅ Threats Peppers Defend Against:")
    threats_defended = [
        "Database breach via SQL injection",
        "Backup theft or exposure",
        "Insider access to database only",
        "Physical theft of database servers",
        "Cloud database compromise"
    ]
    for threat in threats_defended:
        print(f"  • {threat}")
    
    print("\n❌ Threats Peppers DON'T Defend Against:")
    threats_not_defended = [
        "Online brute force attacks",
        "Phishing attacks",
        "Application server compromise",
        "Memory dumping attacks",
        "Source code exposure with pepper",
        "Keyloggers or malware"
    ]
    for threat in threats_not_defended:
        print(f"  • {threat}")
    
    print("\n📊 Effectiveness Comparison:")
    
    scenarios = [
        ("Weak password + No pepper + DB breach", "Hours to crack"),
        ("Weak password + Pepper + DB breach", "Impossible to crack"),
        ("Strong password + No pepper + DB breach", "Years to crack"),
        ("Strong password + Pepper + DB breach", "Impossible to crack"),
        ("Any password + Pepper + Full compromise", "Normal cracking time")
    ]
    
    for scenario, result in scenarios:
        print(f"  {scenario:45} → {result}")
    
    print("\n🔑 Key Insights:")
    print("  1. Peppers multiply security layers")
    print("  2. Most effective for database-only breaches")
    print("  3. Requires secure key management")
    print("  4. Complements, doesn't replace, strong hashing")

threat_model_analysis()