Study. uk . com
  1. Home
  2. All questions
  3. Question 326

CISSP study material · question 326 of 500

A password store keeps only the hash of each password, with a fixed application-wide salt and no record of the scheme used. Which three requirements or recommendations of NIST SP 800-63B are missed? Choose three.

  1. Both the salt and the resulting hash must be stored for each password.
  2. A reference to the hashing scheme and cost factor should be stored to allow later migration.
  3. The hash output length must exceed the length of the longest permitted password.
  4. The salt must be at least 32 bits and chosen to avoid collisions between accounts.
Show the answer

Answer: B. A reference to the hashing scheme and cost factor should be stored to allow later migration.
D. The salt must be at least 32 bits and chosen to avoid collisions between accounts.
A. Both the salt and the resulting hash must be stored for each password.

A salt of at least 32 bits chosen against collisions, both salt and hash stored, and the scheme and cost factor recorded so migration stays possible.

Source: NIST SP 800-63B Rev. 4 (NIST) — SP 800-63B-4 > 3.1.1.2 Password Verifiers

Challenge yourself on this topic → Study as cards