nerdexam
GIAC

GSEC · Question #288

What method do Unix-type systems use to prevent attackers from cracking passwords using pre- computed hashes?

The correct answer is C. The algorithm creates hashes using salts or randomized values. Unix-like systems append a random salt value to each password before hashing, ensuring identical passwords produce different hashes and defeating pre-computed rainbow table attacks.

Linux and Cryptography

Question

What method do Unix-type systems use to prevent attackers from cracking passwords using pre- computed hashes?

Options

  • AUnix systems can prevent users from using dictionary words for passwords
  • BThe algorithms creates hashes using a CPU- intensive algorithm.
  • CThe algorithm creates hashes using salts or randomized values
  • DUnix/Linux systems use hashing functions which cannot be reversed
  • EThe system encrypts the password using a symmetrical algorithm

How the community answered

(34 responses)
  • A
    6% (2)
  • B
    3% (1)
  • C
    79% (27)
  • E
    12% (4)

Why each option

Unix-like systems append a random salt value to each password before hashing, ensuring identical passwords produce different hashes and defeating pre-computed rainbow table attacks.

AUnix systems can prevent users from using dictionary words for passwords

Enforcing password complexity policies prevents weak password choices but does not technically defeat pre-computed hash attacks against whatever password is chosen.

BThe algorithms creates hashes using a CPU- intensive algorithm.

CPU-intensive algorithms like bcrypt slow down brute-force and dictionary attacks but the question specifically asks about pre-computed hash attacks, which salting - not compute cost - defeats.

CThe algorithm creates hashes using salts or randomized valuesCorrect

A salt is a randomly generated value stored alongside the hash in /etc/shadow. By concatenating the salt with the plaintext password before passing it to the hash function, each user's hash is unique even if two users share the same password. This invalidates pre-computed hash databases (rainbow tables) because an attacker would need to recompute hashes for every possible salt value.

DUnix/Linux systems use hashing functions which cannot be reversed

One-way (irreversible) hashing is a fundamental property of all cryptographic hash functions and does not prevent an attacker from comparing stored hashes against a pre-computed rainbow table.

EThe system encrypts the password using a symmetrical algorithm

Unix password storage uses one-way hashing, not symmetric encryption; symmetric encryption is reversible and would be less secure for password storage than hashing with a salt.

Concept tested: Password salting to prevent rainbow table attacks

Source: https://csrc.nist.gov/glossary/term/salt

Topics

#password hashing#salting#Unix security#rainbow tables

Community Discussion

No community discussion yet for this question.

Full GSEC Practice