Examkin

Soru

Zorluk: KolayCryptographic and Security Control Weaknesses

A system administrator is reviewing a web application's legacy configuration and discovers that user passwords are saved in the database using the MD5 hashing algorithm without any salt. Which cryptographic weakness does this implementation exhibit?

  1. Use of a collision-prone and cryptographically broken hashing algorithmCevap
  2. B
    Incorrect selection of asymmetric encryption for bulk data storage
  3. C
    Failure to initiate a public key Certificate Signing Request flow
  4. D
    Reliance on network perimeter firewalls instead of host-level access controls

Cevap

Use of a collision-prone and cryptographically broken hashing algorithm
MD5 is an obsolete, cryptographically weak hashing algorithm that is vulnerable to collision attacks. Storing passwords with MD5 without salting allows attackers to reverse or match hashes easily using rainbow tables.

Adım Adım Çözüm

1
Identify the cryptographic mechanism described in the scenario
The system utilizes the MD5 algorithm without salting for password storage
MD5 is a 128-bit hash function widely recognized as weak and obsolete
2
Evaluate the primary vulnerability associated with MD5
MD5 suffers from severe collision vulnerabilities and high speed, making unsalted hashes susceptible to precomputed lookup tables (rainbow tables)
Cryptographic standards dictate using strong, salted key-stretching algorithms (e.g., bcrypt, PBKDF2) instead of broken algorithms like MD5

Anahtar Kavram

Cryptographic Weaknesses and Deprecated Algorithms
Bu soruyu puanla

Konular

Cryptographic and Security Control Weaknesses

Bu konudan daha fazla soru