nerdexam
GIAC

GPEN · Question #409

What is the impact on pre-calculated Rainbow Tables of adding multiple salts to a set of passwords?

The correct answer is B. Salts double the total size of a rainbow table database. Adding salts to passwords forces attackers to generate a separate rainbow table for each unique salt value, making pre-calculated tables impractical and substantially increasing required storage and computation.

Exploitation & Post-Exploitation Techniques

Question

What is the impact on pre-calculated Rainbow Tables of adding multiple salts to a set of passwords?

Options

  • ASalts increases the time to crack the original password by increasing the number oftables that
  • BSalts double the total size of a rainbow table database.
  • CSalts can be reversed or removed from encoding quickly to produce unsaltedhashes.
  • DSalts have little effect because they can be calculated on the fly with applicationssuch as

How the community answered

(23 responses)
  • A
    4% (1)
  • B
    83% (19)
  • C
    13% (3)

Why each option

Adding salts to passwords forces attackers to generate a separate rainbow table for each unique salt value, making pre-calculated tables impractical and substantially increasing required storage and computation.

ASalts increases the time to crack the original password by increasing the number oftables that

Option A's text is truncated, but salts do not merely slow lookups within an existing rainbow table - they invalidate the entire pre-calculated table for any account using a different salt, requiring a full recomputation per unique salt.

BSalts double the total size of a rainbow table database.Correct

When a salt is added to a password before hashing, any pre-computed rainbow table built without that salt becomes invalid because the resulting hash outputs differ entirely from unsalted hashes. Each distinct salt value requires its own independently computed table, multiplying the storage and processing cost required for a pre-calculation attack. The practical effect is that per-password unique salts render universal pre-calculated rainbow tables useless, since the attacker cannot reuse a single table across multiple accounts.

CSalts can be reversed or removed from encoding quickly to produce unsaltedhashes.

Salts are not reversible or strippable from a stored hash without knowing the original plaintext; the salt modifies the input fed to the hash function, so its effect cannot be algebraically removed from the output.

DSalts have little effect because they can be calculated on the fly with applicationssuch as

Properly implemented per-password salts cannot be negated on the fly by cracking tools without first knowing each account's unique salt, making pre-calculated rainbow table attacks infeasible rather than merely slightly slowed.

Concept tested: Effect of password salts on rainbow table pre-computation attacks

Source: https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html

Topics

#rainbow tables#password salting#hash tables#password cracking

Community Discussion

No community discussion yet for this question.

Full GPEN Practice