CyberCertPrepWeb App FundamentalsAuthentication BasicsEASYFree question
What is the role of a 'salt' in password hashing, and what specific attack does it prevent?
- A.A salt is a unique random value stored alongside each password hash. It ensures that two users with the same password have different hashes, preventing rainbow table attacks (precomputed hash databases) and ensuring that cracking one hash does not reveal all identical passwords
- B.A salt increases the entropy of the password itself by appending random characters to the user's input
- C.A salt is used to encrypt the hash before database storage, adding a second layer of protection
- D.A salt allows the server to verify the password without storing any hash at all
Why A is correct
Without salts, identical passwords produce identical hashes - attackers use rainbow tables (precomputed password→hash databases) to crack millions of hashes instantly. A per-user random salt (e.g., 16 bytes) ensures that even 'password123' + salt_A produces a completely different hash than 'password123' + salt_B. Rainbow tables cannot cover salted hashes (the salt space is too large). Modern algorithms like bcrypt, scrypt, and Argon2 automatically generate and manage salts - developers should never implement salting manually.
Know someone studying for Web App Fundamentals? Send them this one.