4.2 Authentication

A cryptographic hash function takes data of any length and produces a fixed-length string of bits called the hash (also called a checksum, message digest or digest). Well-known ones include MD5 (128 bits), SHA-1 (160 bits), SHA-256 (256 bits), SHA-512 (512 bits), NTHash and RIPEMD-160.

Good hash functions have four properties. They're repeatable (the same input always gives the same hash), fixed-length (the output size never changes, whether you hash one letter or a whole movie), pre-image resistant (given a hash, you can't work out the input) and collision resistant (it's very hard to find two inputs with the same hash).

An n-bit hash has 2ⁿ possible outputs, but there are infinitely many possible inputs, so collisions must exist. They just need to be impractical to find. When someone finds an efficient way to force collisions, the function is deprecated, meaning it's no longer used where security matters. MD5 and SHA-1 are deprecated.

A system shouldn't store your actual password. If an adversary stole a plaintext password file, they'd instantly know everyone's password. Instead, the system stores the hash. When you log in, it hashes what you typed and compares that to the stored hash. A match means you're in.

But if two users pick the same password, they'd have identical hashes, and cracking one cracks both. So systems add salt: a few random bits, unique to each user, hashed together with the password. Same password plus different salt gives a different hash.

If an adversary gets a real user's password and there's no MFA, they can do anything that user can do. Online attacks try username and password pairs on a live login portal:

• Trying stolen or leaked credentials. Stolen user databases are sold or posted online, and many people reuse passwords, so a password leaked from one site often opens others.
• Password spraying: trying one common password against many different accounts.
• Credential stuffing (as this course defines it): trying common default credentials, like the factory admin login on a router, switch or IoT device, or stolen account credentials. Outside this course, the term usually means replaying username and password pairs leaked from other sites.

Offline attacks happen after an adversary steals a password hash database. On their own computer, they hash huge numbers of guesses and compare each result to the stolen hashes. Because nothing touches the real login page, account lockouts can't stop them, and nothing shows up in the victim's logs.

Brute force tests every possible password; a dictionary attack tests a list of common passwords; a rainbow table attack uses a precomputed table of common passwords and their hashes, sorted by hash, so each stolen hash can be looked up quickly. Salt defeats rainbow tables, since a precomputed table can't include every user's random salt.

• Something you know (knowledge): password, PIN, answers to challenge questions. It must be hard to guess, but that can also make it hard to remember.
• Something you have (possession): access card, bank card, phone, authentication token. The harder it is to steal or copy, the better.
• Something you are (biometric): fingerprint, palm print, face, iris or retina, voice. Hard to duplicate because it's unique to you.
• Somewhere you are (location): Wi-Fi, GPS, time zone settings or IP address. Rules can allow or deny access based on location.
• Multifactor authentication (MFA) requires at least two separate factors, which is more secure than one. A password plus a security question is still just one factor type (two things you know), so it isn't true MFA.

• Complexity: new passwords must include each character set (uppercase, lowercase, digits, special characters).
• Minimum length: longer passwords take far longer to crack. Current U.S. guidance (NIST SP 800-63B, revision 4, August 2025) puts length ahead of complexity: at least 15 characters when a password is the only factor, and no forced mix of character types.
• Maximum age: users must change passwords every set number of days, often 90 or 120. Changing a stolen password can lock an adversary out, but NIST's current guidance (SP 800-63B, revision 4, August 2025) says not to force changes on a schedule, only when there's evidence a password was compromised, because people respond with predictable patterns like Spring2027! becoming Summer2027!. On the exam, know both the setting and this trade-off.
• Password history: the system stores several previous password hashes, often 5 to 10, so users can't reuse them.
• Lockout: after a set number of failed attempts, often 3 to 5, the account locks for a period, which stops endless online guessing.