Examkin

Question

Difficulty: EasyCryptographic and Security Control Weaknesses

A system administrator is reviewing a web application's legacy configuration and discovers that user passwords are saved in the database using the MD5 hashing algorithm without any salt. Which cryptographic weakness does this implementation exhibit?

  1. Use of a collision-prone and cryptographically broken hashing algorithmAnswer
  2. B
    Incorrect selection of asymmetric encryption for bulk data storage
  3. C
    Failure to initiate a public key Certificate Signing Request flow
  4. D
    Reliance on network perimeter firewalls instead of host-level access controls

Answer

Use of a collision-prone and cryptographically broken hashing algorithm
MD5 is an obsolete, cryptographically weak hashing algorithm that is vulnerable to collision attacks. Storing passwords with MD5 without salting allows attackers to reverse or match hashes easily using rainbow tables.

Step-by-Step Solution

1
Identify the cryptographic mechanism described in the scenario
The system utilizes the MD5 algorithm without salting for password storage
MD5 is a 128-bit hash function widely recognized as weak and obsolete
2
Evaluate the primary vulnerability associated with MD5
MD5 suffers from severe collision vulnerabilities and high speed, making unsalted hashes susceptible to precomputed lookup tables (rainbow tables)
Cryptographic standards dictate using strong, salted key-stretching algorithms (e.g., bcrypt, PBKDF2) instead of broken algorithms like MD5

Key Concept

Cryptographic Weaknesses and Deprecated Algorithms
Rate this question

Topics

Cryptographic and Security Control Weaknesses

More questions from this topic