Week 13: Secure Password Generation and Storage

Question 1

What are some ways that user Alice can authenticate herself to Bob?

Answer 1

• token
• cookie
• password
• passphrase
• fingerprint

Question 2

What’s the difference between an online attack and a offline attack?

Answer 2

Online attack - trying to input password into server

Offline attack - password protected data obtained, hacker attempts offline

Question 3

Why are passwords salted?

Answer 3

Each password has a unique salt added before hashing so same passwords don’t generate the same hash and so finding the password based on hash is harder.

Question 4

What is key stretching?

Answer 4

Making hashing deliberately slow so multiple attempts take much longer.

Question 5

What is PBKDF2 and how does it work?

Answer 5

Function to make hashing slower. Hashes multiple times.

Question 6

What is the disadvantage of PBKDF2?

Answer 6

It can be done faster with GPUs by parallelization.

Question 7

What are memory hard functions?

Answer 7

Hash functions that take up a lot of memory (ie. scrypt, bcrypt)