Topic 4.2 Notes – Authentication

What Authentication Is

Authentication proves identity. Authorization decides what that identity can access or do. That difference matters because a stolen password can let an attacker be treated as the real user, with that user’s permissions.

The proof used for login is an authentication factor. In this topic, secure authentication depends on three linked protections:

• Safe password storage so a stolen database does not reveal plaintext passwords
• Resistance to password attacks such as guessing, reuse, and cracking
• Strong login requirements so one stolen secret is less likely to be enough

If the compromised account is an admin account, the damage is much worse because the attacker gets higher privileges.

How Password Hashing Works

A cryptographic hash function takes input of any length and produces a fixed-length output. That output can be called a hash, checksum, message digest, or digest.

This basic idea is what the diagram is showing.

Hash function input and fixed-length output

Common names you should recognize:

• MD5
• SHA-1
• SHA-256
• SHA-512
• NTHash
• RIPEMD-160

Properties

• Collision resistance means it is hard to find two different inputs with the same output. Collisions must exist because an $n$-bit hash has only $2^n$ possible outputs.
• Pre-image resistance means that given a hash, it is infeasible to recover the original input.
• Repeatability means the same input always gives the same hash.
• Fixed length means one hash function always gives the same output size.

That repeatability is what makes password checking work.

Password storage and login

1. A user creates a password.
2. The system hashes it.
3. The system stores the hash, not the plaintext password.

At login:

1. The user enters a password.
2. The system hashes the entered password the same way.
3. The system compares that new hash to the stored one.
4. Matching hashes mean the password is accepted.

Salt

A salt is random data added to a password before hashing. Each user gets a unique salt.

• Two users with the same password will still have different stored hashes
• Salt makes rainbow tables much less useful
• The salt is stored too, because the system needs it again during login

Also know the weak hashes to avoid in secure settings. MD5 and SHA-1 are deprecated because attackers found efficient ways to force collisions.

Types of Password Attacks

There are two big categories.

Online and offline

This distinction gets tested a lot. If hashes are stolen, account lockout does not stop offline cracking.

Main attack methods

• Leaked and reused credentials mean one breach can lead to access on another site because users reuse passwords.
• Password spraying tries one common password against many accounts, like Fall2026!.
• Credential stuffing uses stolen username-password pairs or default credentials, especially on routers, switches, and IoT devices.
• Brute force tests all possible passwords in a search space.
• Dictionary attack tests a list of likely passwords and patterns.
• Rainbow table attack searches a precomputed password-hash table for a match. Salts weaken this attack a lot.

Authentication Factors and MFA

There are four factor categories you need to know as a set:

• Something you know such as a password, PIN, or challenge question
• Something you have such as a phone, card, or token
• Something you are such as a fingerprint, face, iris, retina, or voice
• Somewhere you are such as GPS, Wi-Fi, time zone, or IP-based location

MFA means at least two different factor categories.

• Password + phone code = MFA
• Bank card + PIN = MFA
• Password + fingerprint = MFA

The exam trap is simple. Password + PIN is not MFA because both are knowledge factors.

Login Settings That Improve Security

These settings work best together, not alone:

• Password complexity requires character types such as uppercase, lowercase, numbers, and special characters.
• Minimum password length matters a lot because longer passwords sharply increase cracking difficulty.
• Maximum password age is often 90 to 120 days. It can limit use of a compromised password, but it can also cause predictable patterns like PasswordFall2028.
• Password history stores previous password hashes, often 5 to 10, to block reuse.
• Account lockout locks an account after about 3 to 5 failed attempts. This helps against online attacks only.