Question

How does the application of salt and pepper techniques to stored password hashes protect against pre-computed rainbow table attacks?

Accepted Answer

A rainbow table is a pre-computed list of millions of common passwords paired with their corresponding hash values, which are fixed-length strings of characters generated by a cryptographic function. By looking up a stolen password hash in this table, an attacker can instantly reveal the original password without doing any complex math. Salt is a unique, random string of characters added to every user&#x27;s password before the hashing process occurs. Because the salt is different for every user, even two people with the same password will produce completely different stored hashes, forcing an attacker to create a unique rainbow table for every individual user rather than using one table for the entire database. Pepper is a secret value added to the password, typically stored outside the database in the application&#x27;s configuration or a separate security module. While the salt protects against large-scale, pre-computed attacks, the pepper adds a layer of &#x27;secret knowledge&#x27; that an attacker cannot access even if they gain full read access to the database itself. Imagine the salt as a personalized serial number on every product and the pepper as a master key kept in a separate safe; even if a thief steals the product records, they cannot reverse the hashing process without that specific key. Together, these techniques ensure that rainbow tables become computationally impractical because the attacker would need to know both the unique salt and the secret pepper to successfully generate a matching hash.

Home → All Courses → Engineering and Technology Courses → Foundations of Cybersecurity → Flashcard

How does the application of salt and pepper techniques to stored password hashes protect against pre-computed rainbow table attacks?

Community Answers