How can we prevent dictionary attacks on password hashes ?
-
Hashing the password twice
-
Encrypting the password using the private key
-
Use an encryption algorithm you wrote your self so no one knows how it works
-
Salting the hash
To prevent dictionary attacks on password hashes, one common technique is salting the hash.
Option A: Hashing the password twice is not a solution to prevent dictionary attacks. It is a technique called key stretching that makes brute-force attacks slower, but it does not prevent dictionary attacks.
Option B: Encrypting the password using the private key is not a solution to prevent dictionary attacks. Encryption is reversible, and an attacker with the private key can easily obtain the original password.
Option C: Using an encryption algorithm you wrote yourself is not a solution to prevent dictionary attacks. It is not recommended to invent your own encryption algorithm because it can have vulnerabilities that attackers can exploit.
Option D: Salting the hash is a technique that involves adding a random string of characters to the password before hashing. The salt is unique for each password and makes it difficult for an attacker to use precomputed hash tables (rainbow tables) to find the original password. Therefore, it is an effective method to prevent dictionary attacks.
Therefore, the correct answer is:
The Answer is: D
Correct answer: Salting the hash.
A dictionary attack precomputes hashes of common passwords/words and compares them against stolen hash values to quickly find matches. Adding a unique, random salt to each password before hashing means the same password produces a different hash for every user, so an attacker can't reuse a single precomputed dictionary/rainbow table across accounts — they'd have to redo the attack per salt, massively increasing the cost.
Hashing twice doesn't defeat a dictionary attack (an attacker can just apply the same function twice when building their dictionary). Encrypting with a private key is a form of reversible encryption, not the recommended way to store passwords, and doesn't address the dictionary-attack vector either. A homegrown, unproven encryption algorithm is a well-known anti-pattern ("security through obscurity") and is not a valid defense.