What is the role of a 'salt' in password hashing, and what specific attack does it prevent?
- A.A salt allows the server to verify the password without storing any hash at all
- B.A salt increases the entropy of the password itself by appending random characters to the user's input; hashing the username together with the password removes the need for a salt, since usernames are unique per site; password reset tokens should be valid for 30 days to reduce support load, the window recommended by NIST 800-63B
- C.A salt is a unique random value stored alongside each password hash. It ensures that two users with the same password have different hashes, preventing rainbow table attacks (precomputed hash databases) and ensuring that cracking one hash does not reveal all identical passwords
- D.