Examples of Secure Password Storage Techniques

📚 Quick Study Guide

• 🔑 Hashing: A one-way function that transforms a password into a fixed-size string of characters. It's impossible to reverse the process and get the original password back.
• 🧂 Salting: Adding a unique, random string to each password before hashing. This prevents attackers from using pre-computed tables of common password hashes (rainbow tables).
• 🌶️ Key Stretching: Repeating the hashing process multiple times to increase the computational cost of cracking passwords. Algorithms like PBKDF2, bcrypt, and Argon2 are commonly used.
• 🛡️ Password-Based Key Derivation Function 2 (PBKDF2): A key stretching algorithm that applies a pseudorandom function (like HMAC-SHA256) to the password along with a salt, repeating the process many times.
• 🔒 bcrypt: A key stretching algorithm that includes its own salting process and is resistant to brute-force attacks.
• 🛡️ Argon2: A key stretching algorithm that is designed to be resistant to both GPU and CPU-based attacks. It has different variations like Argon2d, Argon2i, and Argon2id.
• 💾 Database Storage: Storing hashed and salted passwords in a secure database. Access to the database should be strictly controlled.

🧪 Practice Quiz

1. What is hashing in the context of password storage?
   1. A) Encrypting the password for secure transmission.
   2. B) Transforming the password into an unreadable, fixed-size string.
   3. C) Storing the password in plain text.
   4. D) Compressing the password to save space.
2. What is the purpose of salting passwords?
   1. A) To make passwords easier to remember.
   2. B) To speed up the hashing process.
   3. C) To prevent rainbow table attacks.
   4. D) To encrypt the password.
3. Which of the following is a key stretching algorithm?
   1. A) SHA-1
   2. B) MD5
   3. C) PBKDF2
   4. D) CRC32
4. What does PBKDF2 stand for?
   1. A) Password-Based Key Derivation Function 2
   2. B) Public-Based Key Distribution Format 2
   3. C) Password-Based Kernel Data Function 2
   4. D) Public-Based Key Derivation Format 2
5. Which key stretching algorithm includes its own salting process?
   1. A) MD5
   2. B) SHA-256
   3. C) bcrypt
   4. D) PBKDF1
6. Which of the following algorithms is designed to be resistant to both GPU and CPU-based attacks?
   1. A) SHA-1
   2. B) bcrypt
   3. C) Argon2
   4. D) PBKDF2
7. Why is it important to control access to the database where hashed passwords are stored?
   1. A) To prevent unauthorized modification of passwords.
   2. B) To comply with data storage regulations.
   3. C) To prevent attackers from accessing the hashed passwords.
   4. D) All of the above.