Week3 Flashcards
Suppose that the length of a password is 16 characters. What is the maximum number of possible combinations of characters if the password can include uppercase and lowercase characters but excludes numbers?
62^{16}
52^8
52^{16}
62^6
52^16
Correct! Because we are considering essentially two alphabets (all uppercase letters and lowercase letters), we have 52 possibilities to choose from for each of the 16 characters of the password.
Which attack is incapable of stealing a password? The birthday attack The man-in-the-middle attack (MITM) The brute force attack The phishing attack
The birthday attack
Correct! Although it might sound more like trying a user’s birthday as their password, the birthday attack has nothing to do with stealing passwords. Instead, it is used to create duplicate documents with identical hashes.
Which security measure is a common tool against phishing attacks?
Multi-factor authentication
Encryption
Hashing
Antivirus programs
Multi-factor authentication
Correct! With multi-factor authentication, even if the attacker finds out the user password through a phishing attack, it would still need more information to get access to the account. Such information generally includes OTPs that are sent to the user (phone, email, etc.) at time of each login.
Which attack can generally be used to steal a database that contains passwords?
Cross-site scripting (XSS) attack
Denial of service (DOS) attack.
Password recovery attack
SQL injection attack
SQL injection attack
Correct! If the user input is not verified, it can execute SQL queries to select columns that contain sensitive information.
Which process demonstrates how a user password is verified when the passwords are stored as hashes?
The user entry is encrypted and matched against the hash that is saved in the database.
The user entry is encrypted to match the hash in the database using a special algorithm, which creates an identical output for the hash and encryption.
The user entry is hashed, and this hash is matched against the hash stored in the database.
The user entry is matched against a password, which is generated by reverting the hash.
The user entry is hashed, and this hash is matched against the hash stored in the database.
Correct! This is done to check the integrity of user entry.
Which attack can easily compromise a user’s account if the password is simple and has meaningful information, such as names or birthdays?
The dictionary attack
The phishing attack
The brute force attack
The man-in-the-middle attack (MITM)
The dictionary attack
Correct! Dictionary attacks are way faster compared to brute force attacks because of the reduced search space.
In the context of cryptography, what is “salt”?
A random number appended to user-provided password to create a combination that is used as the password.
A random number used in One Time Passwords for Multi-Factor authentication.
A random number provided to the user after the user has entered the password.
A random data that is used as an additional input to the hash function.
A random data that is used as an additional input to the hash function.
Correct! Salts make it difficult to retrieve the original password by matching hashes of most commonly used passwords against hashes in the stolen password database.
When a user enters the password on their computer to connect to a web server, the password is sent over the network in which form?
As a ciphertext encrypted using asymmetric key encryption
As a hash of the password so that no one could figure out what the password was
As a plaintext so that the web server and anyone else sitting on the line can see it easily
As a ciphertext encrypted using symmetric encryption where the key is stored on the user machine as well as the server.
As a ciphertext encrypted using asymmetric key encryption
Correct! The https protocol ensures that the information is encrypted before it is sent over the network.
Password hashes are salted before storing so that the hashes in the passwords table fails to match with which of the following?
1 / 1 point
Encrypted password received from the user
Hashes computed on the fly in online dictionary attacks
Hashes precomputed in offline dictionary attacks
Hashes computed in the rainbow table attacks
Hashes precomputed in offline dictionary attacks
Correct! This makes an attackers job really difficult as they would have to generate the whole dictionary again for cracking a single password.
How many bits were used for each character in the Unix password scheme?
7 bits
5 bits
8 bits
6 bits
7 bits
Correct! This made the password length (7x8) 56 bits, which was the same as that of DES, which was utilized for hashing at that time in Unix
From the given choices, which was used as a hashing algorithm in earlier Unix systems to store hashes of passwords?
DES
SHA1
MD5
MD4
DES
Correct! In spite of the fact that DES was an encryption algorithm, the system was modified so that it would function as a hashing algorithm.
Which best describes the use of salt in earlier Unix password storage systems?
Salt was supplied along with the password to perturb the S-Boxes in the hashing algorithm.
Salt was used to increase the bit strength of the password from 56 to 70 bits.
Salt was used as the key to encrypt the password before storing.
Salt was supplied to the hashing algorithm along with user password.
Salt was supplied along with the password to perturb the S-Boxes in the hashing algorithm.
Correct! This put salt to better use than the typical append operation.
What was the reason why 25 rounds of hashing were done in the Unix password system?
To strengthen the hash because an encryption algorithm was used instead of hashing.
To achieve the right amount of avalanche effect.
To make the password hashing 25 times slower than usual.
To remove the part of the password, which leaked in the output of hash after an initial round.
To make the password hashing 25 times slower than usual.
Correct! Although a usability problem, this ensured that generating an online dictionary got drastically slowed down making it computationally infeasible to attack.
Which item is stored in the rainbow table?
Passwords generated using the reduction function
The reduction function
Hashes of the candidate password
Candidate passwords
Candidate passwords
Correct! These are stored so that the chain can be recreated in case the final hash matches any hash in the passwords table.
Why is it difficult to brute-force passwords to hashes?
It requires a huge amount of both computation and storage space.
It requires application-specific integrated circuits (ASICs) to generate hashes.
It requires a huge amount of computation.
It requires a huge amount of storage space.
It requires a huge amount of computation.
Correct! Hashing is an expensive operation in terms of computation time and resources.
