A web application is being developed to provide online sales to a retailer. The customers will need to use their username and passwords to login into then profile and complete their order For this reason the application must store user passwords Which approach ensures that an attacker wifi need to crack the passwords one at a time?

The salting technique involves adding a unique, randomly generated value (the "salt") to each user's password before it is hashed. This salt is then stored alongside the hashed password in the database. Because every user has a different salt, even if two users choose the identical password, their stored hashes will be unique. This uniqueness invalidates pre-computed attack methods like rainbow tables, which rely on mapping common passwords to their hashes. Consequently, an attacker who compromises the password database is forced to attempt to crack each password hash individually, using its corresponding salt, which directly fulfills the requirement.

A. Apply the peppering technique: Peppering adds a single, static secret value (the pepper) to all passwords before hashing. Identical passwords will still result in identical hashes, allowing an attacker to target them simultaneously.
B. Store the passwords by using asymmetric encryption: Asymmetric encryption is reversible. If the private key is compromised, an attacker can decrypt all passwords, which is a catastrophic failure and not a recommended practice for password storage.
D. Store the passwords by using symmetric encryption: Symmetric encryption is also reversible. If the single shared key is compromised, an attacker can decrypt the entire database of passwords, violating the principle of secure password storage.

1. NIST Special Publication 800-63B

Digital Identity Guidelines: Authentication and Lifecycle Management. Section 5.1.1.2

"Memorized Secret Verifiers

" states: "Verifiers SHALL store memorized secrets in a form that is resistant to offline attacks. Memorized secrets SHALL be salted and hashed... The salt value SHALL be a 32-bit (or longer) random value generated by an approved random bit generator... The salt value is stored with the hash result." This process ensures each hash is unique.

2. OWASP Foundation

Password Storage Cheat Sheet. Section "Use a salt for all hashes

" explains: "A salt is a unique

randomly generated string that is added to each password before it's hashed... Salting passwords prevents an attacker from using pre-computed hash tables (rainbow tables) to crack passwords." This directly supports the concept of forcing one-at-a-time attacks.

3. Stanford University

CS 155 Course Notes

Web Security. Lecture notes on "Passwords" describe how using a unique salt per user (H(password || salt)) prevents rainbow table attacks and forces attackers to compute a separate table for every user

which is computationally equivalent to a brute-force attack on each password individually.