For storing passwords, it is recommended not to use a fast hash function such as SHA-256 directly but a scheme deliberately designed to take time to compute, such as bcrypt or Argon2. Why?

Answer: C. If the stored hash values are leaked, each guess an attacker tries also becomes expensive, greatly increasing the time needed for brute-force and dictionary attacks

If password hashes are leaked, attackers can hash candidate passwords one after another on their own computers and look for a match. General-purpose hash functions such as SHA-256 are built to process large amounts of data quickly, so with GPUs and similar hardware an enormous number of candidates can be tried per second. Schemes designed for password storage, such as bcrypt and Argon2, have an adjustable number of iterations (cost) and deliberately make each computation heavy. Making each computation a million times slower, for example, makes a brute-force search take a million times longer as well. A legitimate user logging in needs only one computation, so a delay of around 0.1 seconds is not a problem. Argon2 can also be configured to use a lot of memory, which makes massively parallel computation on GPUs or dedicated circuits difficult. Whichever scheme is used, it is combined with a per-user salt.

• A. Computation time has nothing to do with output length. The aim is not to prevent collisions but to slow down brute-force attacks.
• B. No scheme can recover the original password from the hash value; even for legitimate users, the entered password is simply hashed again and compared.
• C. Correct. Making each guess expensive greatly increases the time a brute-force attack takes after a leak.