4.2 Authentication（身份认证）

LO 4 · EK 24 ｜ 严格按大纲顺序学习

▶ 从第一个 EK 开始看课件（幻灯片，可翻页/全屏） 点击下方任意 EK 编号（如 4.2.A.1）也可直接进入对应课件页

学习目标 Learning Objectives

4.2.A Explain why hashes (also called hash outputs, checksums, message digests, or digests) are used to store passwords.

- [4.2.A.1](/ek/4.2.A.1) — A cryptographic hash function (also called a message digest function) is a mathematical algorith… - [4.2.A.2](/ek/4.2.A.2) — An n-bit hash has 2 sup n possible outputs. The number of inputs is infinite, and so inevitably … - [4.2.A.3](/ek/4.2.A.3) — Cryptographic hash functions have the following properties: Bullet Hashes are collision resistan… - [4.2.A.4](/ek/4.2.A.4) — Adversaries try to compromise hashing functions by forcing collisions in their output. If an eff… - [4.2.A.5](/ek/4.2.A.5) — Password-based authentication services shouldn’t store passwords in plaintext, so that if an adv… - [4.2.A.6](/ek/4.2.A.6) — If two users had the same password, then their passwords would have identical hashes in the user…

4.2.B Explain how password attacks exploit vulnerabilities.

- [4.2.B.1](/ek/4.2.B.1) — If an adversary can compromise the password of a legitimate user, and that user’s organization h… - [4.2.B.2](/ek/4.2.B.2) — Password attacks can be classified as online or offline. Bullet Online password attacks attempt … - [4.2.B.3](/ek/4.2.B.3) — Many users reuse the same passwords (or variations of the same password) for all the services an… - [4.2.B.4](/ek/4.2.B.4) — Many users set passwords that are easy to guess, and adversaries will attempt to guess common pa… - [4.2.B.5](/ek/4.2.B.5) — Some services and devices (e.g., switches, routers, and IoT devices) are preconfigured with a de… - [4.2.B.6](/ek/4.2.B.6) — Offline password attacks use automated hash- cracking tools to hash possible passwords and compa… - [4.2.B.7](/ek/4.2.B.7) — A rainbow table attack uses a list of common passwords to generate a rainbow table. A rainbow ta…

4.2.C Determine the type of authentication used to verify the identity of a user.

- [4.2.C.1](/ek/4.2.C.1) — Authentication mechanisms are technical controls that verify the identity of a user to ensure th… - [4.2.C.2](/ek/4.2.C.2) — Knowledge factors can be passwords, PINs, or answers to preselected challenge questions. For a k… - [4.2.C.3](/ek/4.2.C.3) — A possession factor is an object a user has that is unique to them, such as an access card, a ba… - [4.2.C.4](/ek/4.2.C.4) — Biometric factors measure features of the human body and can include fingerprints, palm prints, … - [4.2.C.5](/ek/4.2.C.5) — Location factors use information about Wi-Fi signals, GPS data, time zone settings, and even IP … - [4.2.C.6](/ek/4.2.C.6) — Multifactor authentication (MFA) is when a system uses more than one factor to authenticate a us…

4.2.D Configure login settings to make a device more secure.

- [4.2.D.1](/ek/4.2.D.1) — Requiring complexity in passwords is a login setting that can be configured. When enabled, users… - [4.2.D.2](/ek/4.2.D.2) — Requiring a minimum password length is a login setting that can be configured. This means that u… - [4.2.D.3](/ek/4.2.D.3) — Requiring a maximum password age is a login setting that can be configured. When configured, use… - [4.2.D.4](/ek/4.2.D.4) — Requiring the system to store a certain number of previous user passwords is a login setting tha… - [4.2.D.5](/ek/4.2.D.5) — Requiring a lockout period after a certain number of invalid login attempts is a login setting t…

---

← 返回单元 Unit 4