1answer.
Ask question
Login Signup
Ask question
All categories
  • English
  • Mathematics
  • Social Studies
  • Business
  • History
  • Health
  • Geography
  • Biology
  • Physics
  • Chemistry
  • Computers and Technology
  • Arts
  • World Languages
  • Spanish
  • French
  • German
  • Advanced Placement (AP)
  • SAT
  • Medicine
  • Law
  • Engineering
Nataliya [291]
4 years ago
13

One of the earlier applications of crypto-graphic hash functions was the storage of passwords to authenticate usersin computer s

ystems. With this method, a password is hashed after itsinput and is compared to the stored (hashed) reference password.
(a) Assume that you are a hacker and you got access to the hashedpassword list. You would like to impersonate some of the users.Discuss which of the following three attacks below allow this. Exactlydescribe the consequences of each of the attacks:

•Attack A: You break the one-way property ofh.
•Attack B: You can find second preimages forh.
•Attack C: You can find collisions forh.

(b) Why is this technique of storing passwords often extended by theuse of a so-calledsalt? (A salt is a random value appended to thepassword before hashing. Together with the hash, the value of saltis stored in the list of hashed passwords.) Are the attacks aboveaffected by this technique?

(c) Is a hash function with an output length of 80 bit sufficient for this application?
Computers and Technology
1 answer:
vagabundo [1.1K]4 years ago
6 0

Answer: provided in the explanation part.

Explanation:

This is actually quite long but nevertheless i will make it as basic as possible.

Question (a)  

Attack A:

One way property of hash means that we can't find the input string if given the hash value. The calculation of hash from input string is possible but it is not possible to calculate the input string when given the hash. If the hash function is properly created to have one-way property then there is no way of finding the exact input string. So this attack won't work as the one-way property of hash function can't be broken if the hash function is properly created.

Attack B:

Suppose h() is the hash function. And h(x) = m where x is the string and m is the hash. Then trying to find another string y such that h(y) = m is called finding out the second pre-image of the hash.

Although we can't know the exact initial string for sure, we can by using brute force method find out a second preimage.

This attack will take a very long time. It has the time complexity of 2n. It requires the attacker to have an idea about the kind of passwords that might be used and then brute force all of them to find the string that has the same hash. Each try will have a chance of 1/2n to succeed.

Rainbow attack using rainbow table is often used for such brute-force attack. This comprises a rainbow table which contains passwords and their pre-hashed values.

Therefore, it is not possible to determine the second preimages of h so easily.

Attack C:

Collisions refer to finding out m and m' without knowing any of them. Finding out collisions is easier than finding preimages. This is because after finding out 2n pairs of input/output. The probability of two of them having the same output or hash becomes very high. The disadvantage is that we can't decide which user's hash to break. However, if I do not care about a particular user but want to get as many passwords as possible, then this method is the most feasible.

It has the time complexity of 2n/2.

Hence, this is the attack which has the most success rate in this scenario.

Question (b)

The brute force way of finding out the password usually involves using a rainbow attack. It comprises a rainbow table with millions of passwords and their hashes already computed. By matching that table against the database, the password can be recovered.

Therefore it is often preferred to salt the password. It means we add some random text to the password before calculating the hash.

The salts are usually long strings. Although users usually do not select long passwords, so a rainbow table with hashes of smaller passwords is feasible. But once salt is used, the rainbow table must accommodate for the salt also. This makes it difficult computationally. Although password might be found in the rainbow table. The salt can be anything and thus, make brute-force a LOT more difficult computationally.

Therefore salt is preferred to be added to passwords before computing their hash value.

Question (c)

A hash output length of 80 means there can be exactly 280 different hash values. This means there is at least one collision if 280+1 random strings are hashed because 280 values are used to accommodate all the possible strings. It is not hard with today's computation power to do match against more than this many strings. And doing so increases the probability of exposing a probable password of a user.

Hence, 80 is not a very secure value for the hash length.

cheers i hope this helps!!!!

You might be interested in
What symbol do we use to assign a value to a variable or constant in algorithms?
jekas [21]

The symbol that we do use to assign a value to a variable or constant in algorithms is =.

<h3>What is used to assign a constant to a variable?</h3>

The const keyword is known to be one that tends to specifies a variable or object value that is known to be  constant.

In computing and computer programming, there are different kinds of variables as well as symbols that are used for different purposes.

Note that if you assign a variable, you need to use the = symbol and thus The symbol that we do use to assign a value to a variable or constant in algorithms is =.

Learn more about algorithms from

brainly.com/question/13800096

#SPJ1

3 0
1 year ago
Write code to take a String input from the user, then print the first and last letters of the string on one line. Sample run: En
Ainat [17]
<h2>Answer:</h2>

//import the Scanner class to allow for user input

import java.util.Scanner;

//Begin class definition

public class FirstAndLast{

   //Begin the main method

    public static void main(String []args){

       

       

       //****create an object of the Scanner class.

       //Call the object 'input' to receive user's input

       //from the console.

       Scanner input = new Scanner(System.in);

       

       //****create a prompt to tell the user what to do.

       System.out.println("Enter the string");

       

       //****receive the user's input

       //And store it in a String variable called 'str'

       String str =  input.next();

       

       //****get and print the first character.

       //substring(0, 1) - means get all the characters starting

       //from the lower bound (index 0) up to, but not including the upper

       //bound(index 1).

       //That technically means the first character.

       System.out.print(str.substring(0,1));

       

       //****get and print the last character

       //1. str.length() will return the number of character in the string 'str'.

       //This is also the length of the string

       //2. substring(str.length() - 1) - means get all the characters starting

       // from index that is one less than the length of the string to the last

       // index (since an upper bound is not specified).

       // This technically means the last character.

       System.out.print(str.substring(str.length()-1));

       

       

       

    }  // end of main method

   

} //end of class definition

<h2>Explanation:</h2>

The code has been written in Java and it contains comments explaining important parts of the code. Kindly go through the comments.

The source code and a sample output have also been attached to this response.

To run this program, copy the code in the source code inside a Java IDE or editor and save it as FirstAndLast.java

Download java
<span class="sg-text sg-text--link sg-text--bold sg-text--link-disabled sg-text--blue-dark"> java </span>
4c53f66d970acf88b251b2cf41bcdaf6.png
3 0
3 years ago
Patrick manages the cloud services that are used by a small hospital system. He knows that there are a lot of laws and regulatio
svet-max [94.6K]

Answer:

a. HIPAA

Explanation:

HIPPA represents the Health Insurance Portability and Accountability Act that of the United States which becomes mandatory for protecting the medical data in any form.

Also in the case of data protection that represent the general regulations, PCI DSS, GDPR etc would be used

So the option a is correct

hence, all the other options are wrong

8 0
3 years ago
Which audio format is used to create chiptunes?
Scilla [17]
Chiptune, also known as chip music or 8-bit music, is synthesized electronic music which is made for programmable sound generator suns chops used in vintage computers,consoles , and arcade machines.
5 0
3 years ago
Read 2 more answers
ISDN stands for Internet Services Dynamic Network True/False
aev [14]

The answer is the second option "false." ISDN does not stand for Internet Services Dynamic Network it stands for Integrated Services Digital Network. ISDN is the international communication center for sending data, video, and voice over telephone wires.

Hope this helps.

7 0
3 years ago
Other questions:
  • The keyboard and the mouse____ parts of a computer ​
    8·1 answer
  • A new employee has reported that print jobs are printing as garbled text. Which of the following is MOST likely the reason for t
    8·1 answer
  • Create the tables and appropriate constraints based on the following ER diagram. Use appropriate data types. Note that the size
    7·1 answer
  • If you need seamless access to the OS, ________ is better.
    8·1 answer
  • An eReader has a 956-pixel x 1290-pixel grayscale display with each pixel able to display 32 shades of gray. What is the KiB siz
    9·1 answer
  • What are 3 examples of a idler gear in real life?
    7·1 answer
  • What year did polaroid introduce one-step photography with the SX-70
    14·1 answer
  • What is the name of the first practical asymmetric cryptosystem that was created?
    15·1 answer
  • When you add encryption to a powerpoint presentation what does it do
    14·1 answer
  • security investigators discovered that after attackers exploited a database server, they identified the password for the sa acco
    9·1 answer
Add answer
Login
Not registered? Fast signup
Signup
Login Signup
Ask question!