Objective 1.4: Explain the importance of using appropriate cryptographic solutions
Security+ SY0-701 practice question
During a code review of a customer portal, an auditor finds that passwords are stored as unsalted SHA-256 hashes. Two customers who chose the same password have identical hash values, and the auditor warns that an attacker who compromises the application server could copy the table and crack many of the passwords quickly by using precomputed lookup tables. Which change would MOST directly address the auditor's concern?
- Combine each password with a unique, random salt before hashing it(Correct)
Correct. A unique salt per password makes identical passwords hash to different values and defeats precomputed lookup tables, which are exactly the two problems the auditor found.
- Replace SHA-256 with SHA-512 for all new password hashes
SHA-512 is still a fast, deterministic, unsalted hash. Identical passwords would still produce identical hashes, and precomputed tables can be built for SHA-512 just as they are for SHA-256.
- Encrypt the password hashes with AES-256 using a key stored in the application's configuration file
Encryption is reversible by design. The key sits in the configuration file on the application server the auditor is worried about, so an attacker who compromises that server takes both the table and the key, decrypts the values back to the same unsalted hashes, and then uses precomputed tables against them. It protects the hashes only as well as that key is protected, and it does not fix the weak hashing itself.
- Apply data masking to the hash column so that it appears as asterisks in reports
Data masking only changes how the value is displayed to report viewers. The stored hashes are unchanged, so a stolen table is just as easy to crack.
Explanation
A salt is a random value, unique to each password, that is combined with the password before hashing and stored alongside the hash. Because every hash now depends on its own salt, identical passwords produce different hashes and precomputed (rainbow) tables become useless, since an attacker would need a separate table for every salt. In practice, salting is paired with key stretching (for example bcrypt, scrypt, or PBKDF2) to also slow down brute-force guessing.