GPEN · Question #99
You work as a Web developer in the IBM Inc. Your area of proficiency is PHP. Since you have proper knowledge of security, you have bewared from rainbow attack. For mitigating this attack, you design…
The correct answer is A. Key strengthening. The algorithm applies a hash function repeatedly thousands of times with a salt, which is the key strengthening (also called key stretching) technique used to slow brute-force and rainbow table attacks.
Question
You work as a Web developer in the IBM Inc. Your area of proficiency is PHP. Since you have proper knowledge of security, you have bewared from rainbow attack. For mitigating this attack, you design the PHP code based on the following algorithm:
key = hash(password + salt) for 1 to 65000 do key = hash(key + salt) Which of the following techniques are you implementing in the above algorithm?
Options
- AKey strengthening
- BHashing
- CSniffing
- DSalting
How the community answered
(20 responses)- A85% (17)
- C10% (2)
- D5% (1)
Why each option
The algorithm applies a hash function repeatedly thousands of times with a salt, which is the key strengthening (also called key stretching) technique used to slow brute-force and rainbow table attacks.
Key strengthening (also known as key stretching) deliberately increases the computational cost of deriving a key from a password by iterating the hash function a large number of times - in this case 65,000 iterations. This means an attacker must perform 65,000 hash operations per password guess instead of one, making brute-force and dictionary attacks computationally infeasible. Algorithms like PBKDF2, bcrypt, and scrypt implement this same principle.
Hashing alone refers to applying a hash function a single time; the defining feature of this algorithm is the repeated iteration, which goes beyond simple hashing and constitutes key strengthening.
Sniffing is a passive network attack technique used to capture data in transit and is completely unrelated to password hashing or key derivation algorithms.
Salting refers specifically to appending a random value to a password before hashing to prevent rainbow table attacks; while a salt is used here, the primary technique demonstrated by the 65,000-iteration loop is key strengthening, not salting alone.
Concept tested: Key strengthening and key stretching for password security
Source: https://learn.microsoft.com/en-us/dotnet/standard/security/cryptographic-services
Topics
Community Discussion
No community discussion yet for this question.