Question

A security engineer is redesigning how user passwords are stored in a web application database. The current design applies a single unsalted SHA-256 hash to each password. During a recent penetration test, the assessor recovered numerous passwords quickly using precomputed hash lookup tables. Which change most directly defeats the precomputed-table attack the assessor used?

Accepted Answer

Add a unique random salt to each password before hashing and store the salt with the hash

Answer

Replace SHA-256 with SHA-512 to produce a longer hash digest

Answer

Encrypt the resulting hash values with AES-256 using a database-wide key

Answer

Require users to change their passwords every 30 days