CAS-002 · Question #306
The threat abatement program manager tasked the software engineer with identifying the fastest implementation of a hash function to protect passwords with the least number of collisions. Which of…
The correct answer is C. hash = sha512(password + salt). SHA-512 with a unique salt is the strongest available option among the choices, providing a 512-bit digest with minimal collision probability and resistance to precomputation attacks. The salt ensures uniqueness per password, preventing rainbow table attacks.
Question
The threat abatement program manager tasked the software engineer with identifying the fastest implementation of a hash function to protect passwords with the least number of collisions. Which of the following should the software engineer implement to best meet the requirements?
Options
- Ahash = sha512(password + salt);
- Bhash = md5(password + salt);
- Chash = sha512(password + salt);
- Dhash1 = sha1(password + salt);
How the community answered
(52 responses)- A4% (2)
- B6% (3)
- C88% (46)
- D2% (1)
Why each option
SHA-512 with a unique salt is the strongest available option among the choices, providing a 512-bit digest with minimal collision probability and resistance to precomputation attacks. The salt ensures uniqueness per password, preventing rainbow table attacks.
Although the expression shown is textually identical to C, this is a duplicate distractor in a poorly formatted question; the intended unique wrong answers are B and D, not A.
MD5 is a cryptographically broken algorithm with publicly known and practical collision attacks, making it entirely unsuitable for password protection regardless of salt usage.
SHA-512 produces a 512-bit hash digest, giving it the largest output space and lowest theoretical collision probability of all options listed. Concatenating a unique salt before hashing prevents rainbow table and dictionary attacks by making each hash unique even for identical plaintext passwords. Among the available choices, SHA-512 with salt offers the strongest cryptographic security for password storage.
SHA-1 has been formally deprecated by NIST due to demonstrated collision vulnerabilities, and is no longer considered secure for cryptographic password hashing even when salted.
Concept tested: Selecting secure salted hash algorithm for passwords
Source: https://pages.nist.gov/800-63-3/sp800-63b.html
Topics
Community Discussion
No community discussion yet for this question.