Beginner LevelAuthentication & Authorization
Why should passwords never be stored in plain text and how do bcrypt and Argon2id work?
❓ Interview Prompt: Explain cryptographic password hashing, salts, work factors, rainbow table prevention, and key derivation functions.
Passwords must never be stored in plain text or encrypted with reversible symmetric algorithms. If a database is breached, cleartext or reversible passwords compromise every user account.
Key Concepts:
1
One-Way Cryptographic Hashes: Mathematical functions that convert cleartext passwords into fixed-length strings that cannot be reversed.
2
Salting: Appending a unique, random string (salt) to each password before hashing. Prevents pre-computed Rainbow Table attacks and ensures identical passwords produce completely different hash outputs.
3
Slow Key Derivation Functions (KDFs):
•
Fast hash functions (MD5, SHA-256) process billions of hashes per second on GPUs, making brute-force trivial.
•
Slow algorithms like Argon2id (winner of Password Hashing Competition) and bcrypt enforce configurable memory and CPU work factors, rendering GPU brute-force attacks computationally infeasible.
Code Implementation Example
typescript
import argon2 from 'argon2';
// Hashing password with Argon2id (OWASP recommended KDF)
async function hashPassword(password: string): Promise<string> {
return await argon2.hash(password, {
type: argon2.argon2id,
memoryCost: 65536, // 64 MB RAM work factor
timeCost: 3, // 3 Iterations
parallelism: 4 // 4 Threads
});
}
// Verifying submitted password during login
async function verifyPassword(hash: string, password: string): Promise<boolean> {
return await argon2.verify(hash, password);
}💡Password hashing and verification using Argon2id with memory and CPU work factors.
🎯 Interview Key Takeaway
Hash passwords using slow, salted key derivation algorithms like Argon2id or bcrypt to block GPU brute-force attacks.
#Password Hashing#Argon2#bcrypt#Salting#Beginner
Back to all Authentication & Authorization Questions→