nerdexam
GIAC

GPEN · Question #99

You work as a Web developer in the IBM Inc. Your area of proficiency is PHP. Since you have proper knowledge of security, you have bewared from rainbow attack. For mitigating this attack, you design…

The correct answer is A. Key strengthening. The algorithm applies a hash function repeatedly thousands of times with a salt, which is the key strengthening (also called key stretching) technique used to slow brute-force and rainbow table attacks.

Web Application Penetration Testing

Question

You work as a Web developer in the IBM Inc. Your area of proficiency is PHP. Since you have proper knowledge of security, you have bewared from rainbow attack. For mitigating this attack, you design the PHP code based on the following algorithm:

key = hash(password + salt) for 1 to 65000 do key = hash(key + salt) Which of the following techniques are you implementing in the above algorithm?

Options

  • AKey strengthening
  • BHashing
  • CSniffing
  • DSalting

How the community answered

(20 responses)
  • A
    85% (17)
  • C
    10% (2)
  • D
    5% (1)

Why each option

The algorithm applies a hash function repeatedly thousands of times with a salt, which is the key strengthening (also called key stretching) technique used to slow brute-force and rainbow table attacks.

AKey strengtheningCorrect

Key strengthening (also known as key stretching) deliberately increases the computational cost of deriving a key from a password by iterating the hash function a large number of times - in this case 65,000 iterations. This means an attacker must perform 65,000 hash operations per password guess instead of one, making brute-force and dictionary attacks computationally infeasible. Algorithms like PBKDF2, bcrypt, and scrypt implement this same principle.

BHashing

Hashing alone refers to applying a hash function a single time; the defining feature of this algorithm is the repeated iteration, which goes beyond simple hashing and constitutes key strengthening.

CSniffing

Sniffing is a passive network attack technique used to capture data in transit and is completely unrelated to password hashing or key derivation algorithms.

DSalting

Salting refers specifically to appending a random value to a password before hashing to prevent rainbow table attacks; while a salt is used here, the primary technique demonstrated by the 65,000-iteration loop is key strengthening, not salting alone.

Concept tested: Key strengthening and key stretching for password security

Source: https://learn.microsoft.com/en-us/dotnet/standard/security/cryptographic-services

Topics

#key strengthening#iterative hashing#password security#rainbow table defense

Community Discussion

No community discussion yet for this question.

Full GPEN Practice