Stevens IT requires users to choose passwords that consist of exactly 10 capitalized letters, which are...

 

Transcribed Image Text:

Stevens IT requires users to choose passwords that consist of exactly 10 capitalized letters, which are stored in hashed form using either SHA-1 or SHA-256. Eve compromised Stevens' authentication server, long enough to learn the password hash of Alice, the TA for CS306. (1) Describe and name an attack with which Eve can compute Alice's password. (2) Describe how the above attack is affected, if at all, and why, when the server hashes passwords using user-specific salts, stored in plaintext, that consist of 10 alphanumeric characters. (3) Describe how the above attack is affected, if at all, and why, when Eve has previously taken CS306 and knows and understands the birthday paradox. Stevens IT requires users to choose passwords that consist of exactly 10 capitalized letters, which are stored in hashed form using either SHA-1 or SHA-256. Eve compromised Stevens' authentication server, long enough to learn the password hash of Alice, the TA for CS306. (1) Describe and name an attack with which Eve can compute Alice's password. (2) Describe how the above attack is affected, if at all, and why, when the server hashes passwords using user-specific salts, stored in plaintext, that consist of 10 alphanumeric characters. (3) Describe how the above attack is affected, if at all, and why, when Eve has previously taken CS306 and knows and understands the birthday paradox.