SY0-501 Question #361: Real Exam Question with Answer & Explanation

Question

Which of the following are used to increase the computing time it takes to brute force a password using an offline attack? (Select TWO)

Options

• AXOR
• BPBKDF2
• Cbcrypt
• DHMAC
• ERIPEMD

Explanation

Password-based key derivation functions (KDFs) are specifically designed to be computationally expensive, making offline brute-force attacks impractical by intentionally slowing down the hashing process.

Common mistakes.

• A. XOR (exclusive OR) is a basic bitwise logical operation used in encryption and data manipulation, but it provides no inherent computational cost increase and is trivially fast for attackers to reverse.
• D. HMAC (Hash-based Message Authentication Code) is used for verifying message integrity and authenticity using a secret key, but it is not designed to be computationally expensive and does not slow down password brute-forcing.
• E. RIPEMD is a cryptographic hash function designed for speed and integrity verification, not for password storage; its efficiency makes it unsuitable for defending against brute-force attacks since it can be computed very quickly.

Concept tested. Password hashing algorithms resistant to brute-force attacks

Reference. https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html

No community discussion yet for this question.