Which technique involves adding random bits of data to a password before it is stored as a hash?

Which technique involves adding random bits of data to a password before it is stored as a hash?

• A. Hashing without salt
• B. Encryption
• C. Key stretching
• D. Password salting

Answer: (D)

Adding random data to a password before hashing is known as salting. The random value, called a salt, is unique for each password and is stored alongside the resulting hash. This ensures that even if two users have the same password, their hashes will be different, so precomputed rainbow tables can’t be reused. Because each password-hash pair uses its own salt, an attacker would have to compute hashes separately for every possible password with every salt, which greatly increases the effort required. Encryption isn’t used for password storage because it’s reversible, whereas hashing (with a salt) aims to store a one-way representation. Hashing without a salt leaves you vulnerable to rainbow table attacks. Key stretching, while related in practice to slowing down attackers by increasing computation (and often involving a salt), is a separate technique focused on making hash computations intentionally slower. The technique described here is specifically salting.

Adding random data to a password before hashing is known as salting. The random value, called a salt, is unique for each password and is stored alongside the resulting hash. This ensures that even if two users have the same password, their hashes will be different, so precomputed rainbow tables can’t be reused. Because each password-hash pair uses its own salt, an attacker would have to compute hashes separately for every possible password with every salt, which greatly increases the effort required.

Encryption isn’t used for password storage because it’s reversible, whereas hashing (with a salt) aims to store a one-way representation. Hashing without a salt leaves you vulnerable to rainbow table attacks. Key stretching, while related in practice to slowing down attackers by increasing computation (and often involving a salt), is a separate technique focused on making hash computations intentionally slower. The technique described here is specifically salting.