Examkin

Question

Difficulty: HardCryptographic Concepts and Algorithms

A security analyst is hardening an internal web application's authentication module. An audit reveals two major vulnerabilities: session identifiers are predictable due to weak random seed generation, and user passwords stored in the database are susceptible to rapid offline dictionary and GPU-accelerated rainbow table attacks. Which of the following cryptographic techniques should the security analyst implement to mitigate both vulnerabilities? (Select TWO.)

  1. Utilize key stretching algorithms such as Argon2 or PBKDF2 combined with unique per-user salts for credential storage.Answer
  2. Generate session identifiers using a Cryptographically Secure Pseudorandom Number Generator (CSPRNG).Answer
  3. C
    Encrypt database password entries using asymmetric RSA-4096 public key encryption.
  4. D
    Apply fast single-pass SHA-256 digest hashing without salting across all user credentials.
  5. E
    Append an asymmetric digital signature to each session token using the web server's private key to guarantee randomness.

Answer

The analyst should implement key stretching algorithms (such as Argon2 or PBKDF2) with unique per-user salts for credential storage, and use a Cryptographically Secure Pseudorandom Number Generator (CSPRNG) for session token generation.
To secure session tokens against prediction, a Cryptographically Secure Pseudorandom Number Generator (CSPRNG) must be used to ensure high entropy. To protect stored credentials against offline GPU cracking and rainbow tables, key stretching algorithms like Argon2 or PBKDF2 are required because they introduce artificial computational delay and memory requirements while incorporating unique salts per user.

Step-by-Step Solution

1
Analyze the session token predictability vulnerability.
Identify that session tokens require high entropy and cryptographic unpredictability.
Standard pseudo-random number generators use deterministic algorithms that allow attackers to guess session keys if the seed is discovered.
2
Select the appropriate mechanism for session token generation.
Implement a Cryptographically Secure Pseudorandom Number Generator (CSPRNG).
CSPRNGs are specifically designed to produce output that is statistically indistinguishable from true random numbers.
3
Analyze the password storage cracking vulnerability.
Identify that plain hashing is vulnerable to fast GPU cracking and precomputed rainbow tables.
High-throughput hash functions like standard SHA-256 can be computed billions of times per second on GPU arrays.
4
Select the appropriate mechanism for secure password storage.
Enforce key stretching (Argon2 or PBKDF2) along with salting.
Salting neutralizes rainbow tables by making every hash unique, while key stretching intentionally slows down computation to thwart brute-force cracking.

Key Concept

Cryptographic Key Stretching, Salting, and CSPRNG Randomness
Rate this question

Topics

Cryptographic Concepts and Algorithms

More questions from this topic