You work as a Web developer in the IBM Inc. Your area of proficiency is PHP. Since you have proper knowledge of security, you have bewared from rainbow attack. For mitigating this attack, you design the PHP code based on the following algorithm: key = hash(password + salt) for 1 to 65000 do key = hash(key + salt) Which of the following techniques are you implementing in the above algorithm?

The algorithm described implements key strengthening, also known as key stretching. This technique makes a potentially weak key, such as a user's password, more secure by feeding it into a computationally intensive algorithm. The for loop, which iterates 65,000 times, deliberately slows down the process of generating the final hash. This significantly increases the time and computational resources required for an attacker to conduct offline brute-force or dictionary attacks, even if the salt and the final hash value are compromised. While the process uses hashing and salting, the core technique defined by the iterative loop is key strengthening.

B. Hashing: Hashing is a component of the overall process, but "key strengthening" is the specific term for the iterative, computationally expensive hashing shown in the loop.
C. Sniffing: Sniffing is a passive network attack involving eavesdropping on data packets and is completely unrelated to password storage algorithms.
D. Salting: Salting is used in the algorithm (password + salt), but it is only one part of the defense. The primary technique demonstrated by the 65,000 iterations is key strengthening. ---

1. National Institute of Standards and Technology (NIST) Special Publication 800-132

Recommendation for Password-Based Key Derivation. Section 5.1

"Password-Based Key Derivation Functions

" states: "A PBKDF has a salt and an iteration count as inputs. The salt is used to protect against dictionary attacks

and the iteration count is used to make the PBKDF slow

and thus

to protect against brute-force attacks." The loop in the question serves as the iteration count.

2. PHP Official Documentation

passwordhash() function. The documentation for this modern password hashing function explains the cost option for the BCRYPT algorithm. This parameter controls the number of computational rounds

directly implementing key strengthening. The documentation notes

"The higher this value is

the more time it will take to create the hash." This is the same principle as the 65

000 iterations in the question. (See: php.net/manual/en/function.password-hash.php)

3. Parno

B.

& Perrig

A. (2005). Password-based Authentication and Key Exchange using Memorizable Keys. Carnegie Mellon University School of Computer Science. Technical Report CMU-CS-05-122. Section 2.1

"Key Stretching

" describes the technique: "To thwart a dictionary attack

we can use a key stretching function... which is a function that is slow to compute. For example

we can compute h^k(password) for some large k." This directly corresponds to the algorithm in the question where k is 65

000.