312-50 Question 452
Single answer▪ Cryptography ConceptsDuring an internal security assessment, you review a custom web application that stores user passwords in a database using AES-256 encryption with a single application-wide key kept on the web server. The development team says this is secure because AES-256 is a strong algorithm and the passwords can be recovered for account support. From a CEH perspective, which recommendation best addresses the primary cryptographic weakness in this design while still aligning with password security best practices?
- A
Replace reversible AES encryption with a salted, adaptive one-way password hashing function such as bcrypt, scrypt, or Argon2
- B
Keep AES-256 but generate a unique IV for each password so identical passwords do not produce the same ciphertext
- C
Encrypt the AES key using RSA and store the encrypted key in the same application server to prevent disclosure
- D
Use MD5 with a salt because salting prevents attackers from recovering the original password
Show answer and explanation
Correct answer: A
Explanation
The main issue is not whether AES-256 is a strong cipher; it is that passwords are being stored in a reversible form. In a realistic breach, if an attacker gains access to the web server, application code, or key material, they can decrypt every stored password. Best practice is to store passwords using a salted, adaptive one-way password hashing algorithm such as Argon2, bcrypt, or scrypt. These are specifically designed to slow down offline guessing attacks and avoid the need to recover plaintext passwords. This is consistent with widely accepted guidance, including NIST SP 800-63B, which recommends salted, one-way password hashing with a suitable work factor, and OWASP Password Storage Cheat Sheet, which recommends Argon2id, bcrypt, or scrypt for password storage. In short, strong encryption alone does not make a design appropriate for password storage; choosing the correct cryptographic primitive for the use case is the key concept being tested.
- A. Correct.
Correct. Passwords should generally not be stored with reversible encryption because authentication only requires verifying a submitted password, not recovering the original value. A salted, adaptive one-way hashing function such as bcrypt, scrypt, or Argon2 is designed for password storage and makes offline cracking significantly harder due to configurable work factors and per-password salts. This directly fixes the core issue: compromise of the application key currently exposes all stored passwords.
- B. Incorrect.
Incorrect. A unique IV is important for proper symmetric encryption of data, but it does not solve the fundamental problem that passwords are being stored reversibly. If an attacker obtains the AES key from the server, all passwords can still be decrypted. This option improves encryption hygiene but does not align with password storage best practices.
- C. Incorrect.
Incorrect. Encrypting the AES key with RSA and storing it on the same server does not meaningfully reduce risk if the attacker compromises that server or application context. The application must still be able to decrypt the key to use it, so this mainly shifts the key management problem rather than eliminating the reversible-storage weakness. It also does not address the fact that passwords should not normally be recoverable.
- D. Incorrect.
Incorrect. MD5 is considered cryptographically broken for secure password storage because it is extremely fast and highly susceptible to brute-force and dictionary attacks, even when salted. Salting helps prevent identical hashes and rainbow table reuse, but it does not make MD5 suitable for modern password protection.