312-50 Question 451
Single answer▪ Cryptography ConceptsDuring a web application assessment, you observe that the client stores password hashes in its database using plain SHA-256 with no salt. Management asks which change would most effectively reduce the risk of attackers cracking stolen hashes if the database is exfiltrated, while remaining practical for user authentication at scale. Which option is the BEST recommendation?
- A
Replace SHA-256 with bcrypt and configure a unique random salt for each password
- B
Encrypt all passwords with AES-256 so the application can decrypt them during login
- C
Keep SHA-256 but add a single global salt value stored in the application configuration file
- D
Hash each password twice with SHA-256 to make brute-force attacks infeasible
Show answer and explanation
Correct answer: A
Explanation
The best recommendation is to move from a fast general-purpose hash such as SHA-256 to a dedicated password hashing algorithm like bcrypt with a unique random salt per password. In real-world breaches, attackers typically perform offline cracking against stolen hashes. Fast hashes are unsuitable because they enable high-speed guessing. Password hashing functions such as bcrypt, scrypt, and Argon2 are designed to be computationally expensive, and salts ensure that identical passwords do not produce identical stored values.
This aligns with widely accepted guidance such as the OWASP Password Storage Cheat Sheet, which recommends modern password hashing algorithms with per-password salts and configurable work factors. NIST guidance also supports using salted, one-way key derivation or password hashing mechanisms rather than reversible encryption for password storage. From a CEH perspective, understanding the difference between encryption, hashing, salting, and adaptive password hashing is critical when evaluating how resistant a system is to credential theft and offline attack.
- A. Correct.
Correct. Bcrypt is a password hashing function specifically designed for storing passwords securely. It incorporates a salt automatically and is intentionally slow and tunable via a work factor, which significantly increases the cost of offline cracking attempts. Using a unique random salt per password also prevents identical passwords from producing the same hash and defeats precomputed rainbow table attacks.
- B. Incorrect.
Incorrect. AES-256 is a symmetric encryption algorithm, not a password hashing function. If passwords are encrypted instead of hashed, the application must retain a decryption key, creating a high-value target. Best practice is to store password verifiers using a one-way password hashing algorithm rather than reversible encryption.
- C. Incorrect.
Incorrect. Adding one global salt is better than no salt in some narrow cases, but it does not provide the main security benefit of per-password salts. A global salt still allows attackers to identify users with the same password and does not adequately prevent efficient large-scale cracking of many hashes at once. Modern guidance calls for a unique salt per password record.
- D. Incorrect.
Incorrect. Rehashing with SHA-256, even multiple times, does not make it a proper password hashing scheme. General-purpose fast hash functions such as SHA-256 are designed for speed, which helps attackers test guesses quickly on GPUs and ASICs. Without a purpose-built adaptive password hashing function, the defense remains weak.