312-50 Question 450
Single answer▪ Cryptography ConceptsDuring an internal security assessment, you discover that a legacy web application stores user passwords using unsalted MD5 hashes. Management asks for a remediation approach that improves resistance to offline password cracking if the database is stolen, while minimizing changes to the authentication workflow. Which option is the MOST appropriate recommendation?
- A
Replace MD5 with SHA-256 and store a single unsalted hash of each password
- B
Encrypt passwords with AES-256 so the application can decrypt them during login
- C
Store passwords using a unique random salt per user and a slow password hashing function such as bcrypt, PBKDF2, or scrypt
- D
Use RSA to hash the passwords before saving them to the database
Show answer and explanation
Correct answer: C
Explanation
The best recommendation is to store passwords with a unique random salt and a dedicated password hashing algorithm such as bcrypt, PBKDF2, or scrypt. In real-world incident response and penetration testing, unsalted MD5 hashes are considered highly vulnerable because they are fast to compute and easily attacked offline once exfiltrated. Modern best practices from sources such as NIST SP 800-63B and OWASP Password Storage guidance emphasize using salted, adaptive one-way password hashing functions rather than fast general-purpose hashes or reversible encryption. While Argon2 is also a strong modern choice, the listed option correctly identifies the key remediation principle: use per-user salts and slow password hashing to make offline cracking substantially harder.
- A. Incorrect.
This is incorrect because simply switching from MD5 to SHA-256 without a salt does not adequately protect against offline cracking. SHA-256 is a fast general-purpose hash, which makes it efficient for attackers to test large numbers of password guesses using GPUs or ASICs. Unsalted hashes also allow identical passwords to produce identical outputs, enabling rainbow table and hash-comparison attacks.
- B. Incorrect.
This is incorrect because passwords generally should not be stored in decryptable form. If AES encryption is used, the application must protect and access the encryption key, creating a single point of failure: if an attacker obtains both the database and the key, all passwords can be recovered. Best practice is password verification via one-way password hashing, not reversible encryption, unless there is a specific requirement to recover the original secret.
- C. Correct.
This is correct because a unique salt per user prevents identical passwords from producing the same stored value and defeats precomputed rainbow tables. Using a slow, adaptive password hashing function such as bcrypt, PBKDF2, or scrypt significantly increases the cost of brute-force and dictionary attacks compared with fast hashes like MD5 or SHA-256. This approach aligns with modern password storage guidance and typically requires only changes to how passwords are stored and verified, not a complete redesign of the login process.
- D. Incorrect.
This is incorrect because RSA is an asymmetric encryption/signature algorithm, not a password hashing algorithm. It is not designed for securely storing passwords and would be an improper use of public-key cryptography. This option reflects a common misconception that any cryptographic algorithm can be used interchangeably for hashing, encryption, or signing.