ibps-so 2016 · Question 16 of 394

The application that authenticates internet-banking customers of Chandrabhaga Urban Bank stored, until the review, the unsalted hash of each customer's password. The reviewer demonstrated that two customers who had chosen the same weak password carried identical entries in the table, and that a precomputed table of hashes bought for a few thousand rupees recovered several thousand of the passwords within an hour. He has required that a fresh random value be generated for every customer, stored alongside the entry, and combined with the password before the hash is computed. The value so required is a salt, and its e ect is correctly stated as follows:

1. AIt enciphers the password so that the original password can be recovered from the stored entry by the bank whenever a customer forgets it
2. BIt lengthens the password to the xed width required by the hash function, without which the function could not be applied at all
3. CBecause a distinct random salt is combined with each password before hashing, two customers with the same password no longer carry the same stored entry, and a precomputed table such as a rainbow table becomes useless, since the attacker would have to build a separate table for every saltCorrect
4. DIt replaces the hash function with a cipher, so that the stored entry is a ciphertext rather than a digest
5. EIt ensures that the same password always produces the same stored entry across all customers, which is what makes comparison at logon possible