Salt/pepper and Stretching for hashedPhoneNumber

[ToshiWakayama-KDDI]

Hello guys,

I need your help. For hashedPhoneNumber, is it correct understanding that simple SHA-256 hashing is used and any of Salt/pepper and Stretching is not used?

Many thanks,
Toshi

[ToshiWakayama-KDDI]

Hi all,

Could anyone give any feedback?

Thanks,

[HuubAppelboom]

Why would you want to do this ? What is the use case ?

In Mobile Connect, we always used a simple SHA-256 hashing, and not a salt/pepper and stretching. The reason is that for a first protection of peoples privacy this is sufficient, and implementation and roll-out is simple.

If you want to working with salt and pepper and stretching, you also need to come up with a standard for exchanging the salt/pepper between all parties (multiple API Providers and a API Consumer), and that may become quite complex. In any acse, if we start specifying something optional, I would recommend that it also works for other APIs where personal information is a a request body, for example KYC match.

[fernandopradocabrillo]

Hi @ToshiWakayama-KDDI I can confirm that our implementation is not using salt/pepper or stretching

[bigludo7]

Hello, same for us - we use SHA-256.

[ToshiWakayama-KDDI]

Thank you all for your answers. It seems everyone uses simple SHA-256 for the current Number Verification API. Probably we may consider enhanced feature for higher security in future, but my current focus is implementation of the API and my question is cleared. So, I am happy to close the discussion for the time being, if others are ok.

Many thanks,