SY0-501 · Question #34
Which of the following cryptographic attacks would salting of passwords render ineffective?
The correct answer is B. Dictionary. Password salting adds a unique random value to each password before hashing, making pre-computed hash tables of common dictionary words unusable and thereby rendering dictionary attacks ineffective.
Question
Which of the following cryptographic attacks would salting of passwords render ineffective?
Options
- ABrute force
- BDictionary
- CRainbow tables
- DBirthday
How the community answered
(45 responses)- A7% (3)
- B71% (32)
- C18% (8)
- D4% (2)
Why each option
Password salting adds a unique random value to each password before hashing, making pre-computed hash tables of common dictionary words unusable and thereby rendering dictionary attacks ineffective.
Brute force attacks systematically try every possible password combination; salting increases the computational effort required for each individual guess but does not fundamentally render the iterative guessing approach ineffective.
Salting involves adding a unique, random string (the salt) to a password before it is hashed. This ensures that even if an attacker possesses a dictionary of common passwords, their pre-computed hashes will not match the uniquely salted hashes stored on the system. This fundamentally renders traditional dictionary attacks, which rely on comparing a single set of pre-computed common password hashes against stolen credentials, ineffective.
Although salting does render rainbow tables ineffective by making each password's hash unique due to its distinct salt, the question focuses on dictionary attacks, which directly leverage lists of common words and whose effectiveness is nullified by salting's unique hash generation.
A birthday attack exploits the probability of hash collisions within a hash function. Salting changes the input to the hash function but does not alter the hash function's underlying collision resistance properties.
Concept tested: Password salting and dictionary attacks
Source: https://learn.microsoft.com/en-us/dotnet/api/system.security.cryptography.rfc2898derivedbytes.salt?view=net-8.0
Topics
Community Discussion
No community discussion yet for this question.