Password Security

Question 1

What is a password?

Answer 1

A shared secret used to
gain access to a system
* Known to:
* A user of the system
* The system itself

Question 2

Authentication

Answer 2

• Authentication is the process of verifying an actor’s identity
• Critical for security of systems
• Permissions, capabilities, and access control are all
  contingent upon knowing the identity of the actor

Question 3

Why is obtaining a password
important?

Answer 3

• Obtaining a user’s password can be among the first steps into gaining access to a system

Question 4

How Strong is a Password?

Answer 4

A password’s strength depends on how long it takes an attacker to guess it.

Attackers often try all possible combinations of characters (brute-force).

Longer passwords are stronger because the number of possible combinations increases exponentially with length

Question 5

How to measure uncertainty with
Entropy

Answer 5

• Minimum uncertainty when:
• You know an event will definitely happen
• You know an event will never happen
• Maximum uncertainty when:
• Probability of events is the same

Question 6

Why is a high entropy desirable?

Answer 6

A higher entropy implies a greater number of combinations of symbols
that need to be checked which increases the time to crack a password

So, the implication is that the higher the entropy of a password, the greater
its strength

Question 7

cons of entropy

Answer 7

People don’t create passwords with equal chances for each character.

Some symbols/letters are used more often than others (depends on language).

The next character often depends on the previous ones (not truly random)

Question 8

Problem: Password File Theft

Answer 8

• If the passwords are plain text, what happens?
• The attacker can now log-in as any user, including
  root/administrator
• Passwords should never be stored in plain text

Question 9

Hashed Passwords

Answer 9

• Key idea: store hashed passwords
• Use one-way cryptographic hash functions.
• Good examples: sha256, sha512, sha3, shake
• Bad examples: md5, crc, sha1
• Easy to go from input to a hash, hard to find input from hash

Cryptographic hash function Transforms input data into scrambled, fixed-size output.

Deterministic: Same input always gives the same output

Question 10

cons of bad hashes

Answer 10

Hash Collisions

Bad hashes (like MD5, SHA-1) are vulnerable to collisions, where two different inputs produce the same output.

This violates one of the key properties of a secure hash: collision resistance.

Limited Output Size (Pigeonhole Principle)

Hashes have a fixed size (e.g., SHA-1 = 160 bits), but input size can be infinite.

Eventually, different inputs must map to the same output, allowing collisions.

Question 11

Hardening Password Hashes

Answer 11

Problem: Cryptographic hashes are deterministic
→ Same input always gives the same output
→ So attackers can precompute hash lists (rainbow tables) to crack passwords.

Solution: Use a unique salt for each password
→ A random value(S) added to the password before hashing
→ Makes hashes unique, even for identical passwords.

Stored passwords should always be salted to make them unique and slow down attacks.

Salting forces attackers to brute-force each password separately (no reused hash lookups).

Question 12

how to make salted passwords safer

Answer 12

Normal hash algorithms are too fast, allowing GPUs to brute-force passwords easily.

Solution: Use specially designed slow hash functions like bcrypt, scrypt, PBKDF2.

These algorithms have a work factor to increase calculation time, making attacks slower.

scrypt also requires a lot of memory, making brute-force attacks even harder.