Study. uk . com
  1. Home
  2. All questions
  3. Question 327

CISSP study material · question 327 of 500

A verifier adds a keyed hashing step using a secret only it holds. Where does NIST SP 800-63B say that key should live, and what does the step achieve?

  1. Separately from the hashes, ideally in a hardware security module or trusted execution environment, making brute force on a stolen hash file impractical while the key stays secret.
  2. Alongside the hashes in the same database, so the two can be rotated together.
  3. In the salt field of each record, so that each password gets a distinct key.
  4. In the application source code, so that deployment guarantees consistency.
Show the answer

Answer: A. Separately from the hashes, ideally in a hardware security module or trusted execution environment, making brute force on a stolen hash file impractical while the key stays secret.

The secret key must be stored separately from the hashed passwords and should be held and used within a hardware-protected area, which makes brute-force attacks impractical while it remains secret.

Source: NIST SP 800-63B Rev. 4 (NIST) — SP 800-63B-4 > 3.1.1.2 Password Verifiers

Challenge yourself on this topic → Study as cards