Test
4b Password storage
Este test tiene tipos de pregunta que se abren en el reproductor de siempre.
Preguntas del test (8)
1Password storage:
> use [blank_start]salt[blank_end] & [blank_start]iteration[blank_end]s: slow down password cracking, but doesn't prevent cracking simple password using specialised hardware.
> use [blank_start]memory[blank_end] [blank_start]hard[blank_end] function: prevent cracking since it uses a huge amount of memory- Asalt
- Biteration
- Cmemory
- Dhard
2The importance of salt: without salt...
1. [blank_start]Multiple[blank_end] hashes can be [blank_start]cracked[blank_end] at [blank_start]once[blank_end]
> If you have 1000 [blank_start]hashes[blank_end] and want to know if any of the 1000 accounts has p[blank_start]assword[blank_end] 'maison', compute [blank_start]h[blank_end](maison) & lookup.
> With a smart data structure, you can try crack 1000 pwd with 1 hash
2. Hashes can be [blank_start]calculated[blank_end] in [blank_start]advance[blank_end]
> We could have calculated all hashes in advance & [blank_start]store[blank_end] them in a big table
> we can use [blank_start]time[blank_end]-[blank_start]memory[blank_end] tradeoff to [blank_start]reduce[blank_end] size of table / [blank_start]increase[blank_end] time needed to crack passwords
- AMultiple
- Bcracked
- Conce
- Dcalculated
- Eadvance
- Fhashes
- Gassword
- Hh
- Istore
- Jtime
- Kmemory
- Lreduce
- Mincrease
3Rainbow tables:
> Solves [blank_start]collision[blank_end] problem when there are too many chains in a single table by using a d[blank_start]ifferent[blank_end] reduction function at each [blank_start]row[blank_end]
> Collision: s[blank_start]ame[blank_end] (part of) chains in a table
> Agree on set of [blank_start]password[blank_end]s to crack (8 alpha num characters)
> [blank_start]reduction[blank_end] function r: takes [blank_start]hash[blank_end] as input and produce a [blank_start]password[blank_end] from the set
> Build chains: p1 -hash-> h1 -reduce-> p7 -hash-> h7 -reduce-> p8 -hash-> p3 -reduce-> h3
> Only store 1st & last element cuz we can restore the middle from them
> To crack h7:
>> h7 - [blank_start]reduce[blank_end] -> -[blank_start]hash[blank_end]-> until reach a known e[blank_start]nd[blank_end] of chain
>> find the h[blank_start]ead[blank_end], reduce/hash until reach password that hash to h7 => found p7
- Areduce
- Bhash
- Cnd
- Dead
- Ecollision
- Fame
- Gifferent
- Hrow
- Ipassword
- Jreduction
- Khash
- Lpassword
4What cryptographic primitive can we use to combine a salt and a hash?
> [blank_start]HMAC[blank_end]- AHMAC
5Using salt:
> Store [blank_start]salt[blank_end] & [blank_start]hash[blank_end] in DB
>When user login in DB, hash(pwd || salt) and compare with the hash saved in DB- Asalt
- Bhash
6Using only salt is not enough. We need to use [blank_start]salt[blank_end] + [blank_start]iteration[blank_end]s => apply hash function on .hexdigest multiple times recursively.
- Asalt
- Biteration
7Memory hard functions:
> functions run through many [blank_start]steps[blank_end]
> [blank_start]intermediate[blank_end] results stored in memory
> each step depends on results from [blank_start]previous[blank_end] step
> if you don't have enough memory, you can still get the final results, but you need to calculate the intermediate results again and again >>> slow down
eg. Scrypt, [blank_start]Argon[blank_end]2- AArgon
- Bsteps
- Cintermediate
- Dprevious
8It is safe to use a hash function that is neither resistant to 2nd-preimage nor to collisions to password hashing.
- AVerdadero
- BFalso
Información
- Descripción
- - (4 Database security, Password storage, PAKE) Information security Test sobre 4b Password storage, creado por Yawen Hou el 10/06/2019.
- Autor
- Yawen Hou
- Idioma
- English
- Visitas
- 2
- Etiquetas
- Valoración
- Aún sin valoraciones Valora este test