Passwords

Question 1

What are the 3 steps of offline dictionary attacks?

Answer 1

1) attacker gets a password file 2) attacker gets an encrypted/hashed password 3) attackers tries password from dictionary of common passwords, and compares with the encrypted/hashed one

Question 2

What are 3 countermeasures to offline attacks?

Answer 2

Store hash of password, add password to salt, keep passwords away from userIDs

Question 3

What are 3 properties of Hash Functions?

Answer 3

1) Non reversible (use hash to hash, cannot use to unhash) 2) Fixed size produced 3) Hash produced is unique

Question 4

What are 4 step to hash salting?

Answer 4

1) Get password 2) Add salt 3) Compute hash 4) Store hash and salt

Question 5

What are Rainbow Tables?

Answer 5

precalculated tables for reversing hash functions

Question 6

What are 2 positives of Rainbow Tables?

Answer 6

Rainbow tables do not take much space, brute force takes much more time