CompTIA CASP+ Practice Test

Which hash function implementation minimizes collisions when protecting passwords?

1. hash = sha256(password + salt);

2. hash = sha512(password + salt);

3. hash = sha512(hash + password + salt);

4. hash = sha1(password + salt);

The correct answer is: hash = sha512(hash + password + salt);

The implementation that minimizes collisions when protecting passwords involves hashing the initial hash value along with the password and salt. This approach increases complexity and enhances security by making it significantly harder for attackers to reverse-engineer the hashed result. When using the method of first hashing the password and salt and then hashing the resulting hash again with the password and salt, you create a unique hash that is much less likely to collide with another hash for different inputs. This is particularly valuable in password storage, where the goal is to have unique hashes even for users with similar or identical passwords, thereby enhancing security against pre-computed attacks like rainbow tables. In contrast, the other options—hashing the password combined with a salt—do provide a certain level of security but don't employ the additional layer of hashing seen in the correct answer. While SHA-256 and SHA-512 are strong hash functions, simply combining password and salt or using SHA-1 (which is now considered insecure) does not mitigate collision risks as effectively as the iterative hashing approach. Using this multi-step hashing process not only reduces the likelihood of collisions but also makes brute force and dictionary attacks less effective, ultimately leading to a more secure password storage mechanism.