Study. uk . com
  1. Home
  2. All questions
  3. Question 461

CompTIA Security+ study material · question 461 of 611

A team pre-hashes passwords with plain SHA-512 before passing them to bcrypt. Which attack does this enable?

  1. Password shucking, if the inner hash is known from another breach
  2. A timing side channel
  3. A birthday attack on bcrypt
  4. Rainbow table lookup
Show the answer

Answer: A. Password shucking, if the inner hash is known from another breach

Cracking then reduces to breaking the weaker inner function; using an HMAC with a pepper mitigates it.

Source: OWASP Password Storage Cheat Sheet (OWASP) — OWASP Password Storage Cheat Sheet › Pre-Hashing Passwords with bcrypt

Challenge yourself on this topic → Study as cards