Examkin

Question

Difficulty: MediumCryptographic Concepts and Algorithms

A security engineer is designing an authentication microservice for an enterprise web application. The security policy requires storing user credentials in a manner that mitigates offline brute-force and precomputed rainbow table attacks if the credential database is compromised. Which of the following cryptographic techniques should the engineer implement to satisfy this requirement?

  1. Apply a salted key-stretching hashing algorithm with an adjustable work factor.Answer
  2. B
    Encrypt credentials using symmetric AES-256 encryption managed by a central key management service.
  3. C
    Compute an unsalted SHA-256 digest for each password to verify credential integrity.
  4. D
    Generate an asymmetric digital signature for each plaintext credential to establish non-repudiation.

Answer

Apply a salted key-stretching hashing algorithm with an adjustable work factor.
Applying a salted key-stretching password hashing algorithm (such as Argon2, PBKDF2, or bcrypt) satisfies both requirements. Salting appends a unique random value to each password before hashing to defeat precomputed rainbow tables. Key stretching applies a high work factor through repeated iterations to slow down offline brute-force dictionary attacks.

Step-by-Step Solution

1
Identify the threat vectors described in the scenario.
The requirements explicitly call for protection against precomputed rainbow table attacks and high-speed offline brute-force attacks.
Rainbow table attacks rely on precomputed tables of standard hashes, while brute-force attacks test millions of password combinations per second.
2
Evaluate the cryptographic mechanism required to counter precomputed lookup tables.
Adding a unique random salt to each user password ensures that two identical passwords produce different hashes, rendering precomputed tables ineffective.
Salting forces an attacker to compute a custom lookup table for every individual user salt.
3
Evaluate the cryptographic mechanism required to slow down offline brute-force cracking.
Key-stretching algorithms (such as Argon2, PBKDF2, or bcrypt) execute multiple iterations to artificially increase the computational time required per hash calculation.
Slowing down hash generation significantly increases the time required for an attacker to test candidate passwords.

Key Concept

Salted Key-Stretching Hash Functions for Password Protection
Estimated Time:1m 30s
Rate this question

Topics

Cryptographic Concepts and Algorithms

More questions from this topic