SY0-501 · Question #346
Which of the following is the BEST reason for salting a password hash before it is stored in a database?
The correct answer is A. To prevent duplicate values from being stored. Salting a password hash before storage ensures that even identical passwords produce unique stored hash values, primarily to enhance security against various attack types.
Question
Which of the following is the BEST reason for salting a password hash before it is stored in a database?
Options
- ATo prevent duplicate values from being stored
- BTo make the password retrieval process very slow
- CTo protect passwords from being saved in readable format
- DTo prevent users from using simple passwords for their access credentials
How the community answered
(29 responses)- A79% (23)
- B3% (1)
- C3% (1)
- D14% (4)
Why each option
Salting a password hash before storage ensures that even identical passwords produce unique stored hash values, primarily to enhance security against various attack types.
Salting involves appending a unique, random string (salt) to each user's password before it undergoes the hashing process. This crucial step ensures that even if multiple users select the exact same password, their individual stored hash values will be distinct within the database. Consequently, this prevents the storage of identical or duplicate hash values, which enhances security by making it harder for attackers to identify accounts with shared passwords through simple hash comparison or pre-computed tables.
While salting adds computational overhead, its primary purpose is to enhance the security of the hash by making pre-computation attacks more difficult, not specifically to slow down a retrieval process which typically compares a newly hashed password to a stored hash.
Hashing itself transforms a password into an unreadable format; salting enhances the security of this hashed output against attacks like rainbow tables, rather than initially protecting it from being saved in readable format.
Password complexity rules, such as minimum length and character requirements, are used to prevent users from choosing simple passwords, whereas salting strengthens the security of whatever password hash is created.
Concept tested: Password salting for database security
Source: https://learn.microsoft.com/en-us/dotnet/api/system.security.cryptography.rfc2898derivedbytes?view=net-8.0
Topics
Community Discussion
No community discussion yet for this question.