Why hash and salt passwords, and which algorithms are preferred?

• A. To protect passwords if data is leaked; salts prevent rainbow tables; preferred algorithms include Argon2, bcrypt, scrypt, not plain MD5/SHA-1.
• B. To speed up login; salts ensure uniqueness; preferred: MD5, SHA-1.
• C. To compress data; salts reduce size; preferred: AES, DES.
• D. To enable password sharing; salts are optional; preferred: RC4.

Answer: (A)

Hashing and salting passwords protects credentials even if the password database is exposed. Hashing turns a password into a fixed-length value, and salting adds a unique random value to each password before hashing so identical passwords don’t produce the same hash. This defeats rainbow tables and forces attackers to crack each password individually, increasing the effort and time required.

The preferred algorithms are Argon2, bcrypt, or scrypt because they are designed to be slow and resistant to GPU- and ASIC-based cracking, with built-in support for salts and adjustable work factors. They intentionally use memory-hardness and computational cost to make offline attacks impractical as hardware improves.

Killer flaws in the other options: they describe aims like speeding up login or compressing data, which aren’t what password storage needs, and they recommend algorithms (MD5, SHA-1, AES, DES, RC4) that are fast or obsolete and don’t provide proper protection for passwords.