Which of the following statements correctly explain the effect of salt in authentication systems?

Question

BlackTom AI · Accepted Answer

Salt is random data appended or prepended to a password before hashing so that each stored password hash is unique even when users choose the same password.

1) Relevant knowledge points and concepts
- Salt: a unique random value per password stored alongside the hash.
- Precomputed attack (rainbow table): an attacker precomputes hashes for many common passwords once and reuses them to crack stored hashes quickly.
- Brute-force attack: attacker tries candidate passwords and hashes them to compare with stored hashes; cost is proportional to number of hash computations.
- Salt does not increase the inherent entropy of the user password, but it prevents reuse of precomputed results across different salts.

2) Step-by-step reasoning
- Without salt: same password -> same hash. An attacker can use a single precomputed table or one hash computation to identify that password across many accounts.
- With unique salt per user: attacker must compute hash(password + salt_i) for each salt_i. A precomputed table for unsalted passwords is useless because the stored hash depends on the salt.

3) Quantitative illustration (intermediate steps)
- Suppose an attacker can compute 100,000 hashes/sec.
- Cracking one unsalted password by brute force might take, say, 10,000 hash attempts = 0.1 s.
- For N = 1,000 users with unique salts, the attacker must perform those 10,000 attempts per user: 10,000 * 1,000 = 10,000,000 hashes -> 100 s.
- Thus salt multiplies the attacker’s work roughly by the number of different salts (users), increasing complexity.

4) Why the correct answers are correct
- "Salt increases the complexity of brute-force attacks": True, because an attacker must compute hashes per salt, raising computational effort.
- "Salt prevents reuse of precomputed hash tables across users": True, because precomputed unsalted hashes do not match salted stored hashes.

5) Why the other options are incorrect
- "Salt makes hashing faster": False. Salting adds an extra concatenation step and usually does not speed hashing; it may slightly increase work.
- "Salt allows attackers to easily guess passwords": False. Salt makes large-scale guessing and precomputation less effective; it does not make guessing easier.

6) Conclusion
Both "Salt increases the complexity of brute-force attacks" and "Salt prevents reuse of precomputed hash tables across users" are correct, matching the provided answer.

Which of the following statements correctly explain the effect of salt in authentication systems?多项选择题

类似问题

Scenario:Passwords are stored in a database as hashes. Even if the database is compromised, original passwords cannot be recovered. Question: Which cryptographic concept is applied?

To protect passwords in the case when an attacker obtains the password database, _ is used to prevent ___ of the passwords.

When designing a secure system, why is hashing preferred over encryption for storing passwords?

An important technique to mitigate password dictionary attacks is to ___________.

__________ is a technique used to help protect against attacks exposing the contents of the server where password information is stored.

The best way to store passwords is:

更多留学生实用工具

智能学习助手

风格化写作助手

论文查重助手

文献引用助手

课堂转译助手

课堂笔记助手

Quiz搜索助手

学校历年真题

智能刷题助手

智能匹配练习

希望你的学习变得更简单