What is the role of a 'salt' in password hashing, and what specific attack does it prevent?
- A.A salt is a secret pepper kept only on the application server (stored apart from the hash), meaning an attacker with the database dump is unable to start cracking, and it prevents SQL injection by hiding the hash from queries
- B.A salt is a public counter added to the password before each login attempt (a value that rises by one), ensuring that every user's hash changes at each sign in and preventing session replay and brute force alike
- C.A salt is a unique random value stored alongside each password hash. It ensures that two users with the same password have different hashes, preventing rainbow table attacks (precomputed hash databases) and ensuring that cracking one hash does not reveal all identical passwords
- D.A salt is a fixed string shared by all accounts in the application (a global constant in the source code), stored with the code and used to block dictionary attacks against any single password
Why C is correct