Study. uk . com
  1. Home
  2. All questions
  3. Question 265

CompTIA Security+ study material · question 265 of 611

NIST suggests an additional keyed operation over the stored password hash. Where should that secret key live?

  1. In application configuration on the same host
  2. Derived from each user's salt at verification time
  3. Alongside the hashes in the same database table
  4. Separately from the hashes, in a hardware security module or trusted execution environment
Show the answer

Answer: D. Separately from the hashes, in a hardware security module or trusted execution environment

If the key is stolen with the database the extra step adds nothing; separation is what makes brute force impractical.

Source: NIST SP 800-63B Rev. 4 (NIST) — SP 800-63B-4 § 3.1.1.2

Challenge yourself on this topic → Study as cards