Exam CISSP topic 1 question 425 discussion

An attacker has to invest a lot of hardware resources and time to crack the hashes. So I go with C.

cost factor increate time to hash to make mo difficult brute force attacks

C. Use a hash function with a cost factor and a per-user random salt. Hashing with a cost factor: Using a hash function with a cost factor involves applying the hash function repeatedly (a configurable number of times) to slow down the hashing process. This makes it computationally expensive and time-consuming for attackers to perform offline brute-force or dictionary attacks. B. mentions using a hash function with a salt, which is a good practice, but it lacks the cost factor (also known as key stretching) that slows down the hashing process and makes offline attacks more difficult. Using a hash function with a cost factor and a per-user random salt, is the most appropriate and secure method for storing passwords to protect against offline attacks.

c. Verifiers SHALL store memorized secrets in a form that is resistant to offline attacks. Memorized secrets SHALL be salted and hashed using a suitable one-way key derivation function. Key derivation functions take a password, a salt, and a cost factor as inputs then generate a password hash.