CREST Practitioner Security Analyst (CPSA) Practice

Which hashing algorithm is commonly used for password storage?

1. RC4

2. MD5

3. Blowfish

4. AES

The correct answer is: MD5

The commonly used hashing algorithm for password storage is MD5. While MD5 is known for its speed and ease of use, it's important to recognize that it has vulnerabilities that can make it less secure for sensitive information like passwords. Despite its weaknesses, it has been historically utilized in password hashing due to its simple implementation. However, in contemporary best practices, MD5 is often discouraged in favor of more secure algorithms such as bcrypt, scrypt, or Argon2, which provide better protection against attacks like brute force and rainbow table attacks. These more secure algorithms incorporate a concept called "salting" to further enhance password security, which MD5 lacks. The other options listed are not typically used for password hashing. RC4 is a stream cipher, not a hashing algorithm, and is also considered insecure for many applications. Blowfish is a block cipher used for encryption rather than hashing, and AES is another encryption standard that, while secure, is not appropriate for password hashing. In password storage, the focus should be on hashing algorithms specifically designed to securely handle and protect passwords, which is not the primary function of the other choices.