GSEC · Question #288
What method do Unix-type systems use to prevent attackers from cracking passwords using pre- computed hashes?
The correct answer is C. The algorithm creates hashes using salts or randomized values. Unix-like systems append a random salt value to each password before hashing, ensuring identical passwords produce different hashes and defeating pre-computed rainbow table attacks.
Question
What method do Unix-type systems use to prevent attackers from cracking passwords using pre- computed hashes?
Options
- AUnix systems can prevent users from using dictionary words for passwords
- BThe algorithms creates hashes using a CPU- intensive algorithm.
- CThe algorithm creates hashes using salts or randomized values
- DUnix/Linux systems use hashing functions which cannot be reversed
- EThe system encrypts the password using a symmetrical algorithm
How the community answered
(34 responses)- A6% (2)
- B3% (1)
- C79% (27)
- E12% (4)
Why each option
Unix-like systems append a random salt value to each password before hashing, ensuring identical passwords produce different hashes and defeating pre-computed rainbow table attacks.
Enforcing password complexity policies prevents weak password choices but does not technically defeat pre-computed hash attacks against whatever password is chosen.
CPU-intensive algorithms like bcrypt slow down brute-force and dictionary attacks but the question specifically asks about pre-computed hash attacks, which salting - not compute cost - defeats.
A salt is a randomly generated value stored alongside the hash in /etc/shadow. By concatenating the salt with the plaintext password before passing it to the hash function, each user's hash is unique even if two users share the same password. This invalidates pre-computed hash databases (rainbow tables) because an attacker would need to recompute hashes for every possible salt value.
One-way (irreversible) hashing is a fundamental property of all cryptographic hash functions and does not prevent an attacker from comparing stored hashes against a pre-computed rainbow table.
Unix password storage uses one-way hashing, not symmetric encryption; symmetric encryption is reversible and would be less secure for password storage than hashing with a salt.
Concept tested: Password salting to prevent rainbow table attacks
Source: https://csrc.nist.gov/glossary/term/salt
Topics
Community Discussion
No community discussion yet for this question.