Study. uk . com
  1. Home
  2. All questions
  3. Question 324

CISSP study material · question 324 of 500

An engineer proposes storing passwords as a single unsalted SHA-256 digest for speed. Which two properties does NIST SP 800-63B require of stored passwords instead? Choose two.

  1. They must be salted.
  2. They must be encrypted with a key held in the application configuration.
  3. They must be stored only in memory and never written to disk.
  4. They must be put through a password hashing scheme taking password, salt and a cost factor.
Show the answer

Answer: A. They must be salted.
D. They must be put through a password hashing scheme taking password, salt and a cost factor.

Stored passwords must resist offline attack: salted, and hashed by a scheme taking the password, a salt and a cost factor as its inputs.

Source: NIST SP 800-63B Rev. 4 (NIST) — SP 800-63B-4 > 3.1.1.2 Password Verifiers

Challenge yourself on this topic → Study as cards