What is the primary purpose of salting passwords before hashing?

• A. To create a fixed-length output
• B. To speed up hashing
• C. To prevent rainbow table attacks
• D. To ensure integrity and authenticity

Answer: (C)

Salting passwords before hashing is mainly to defeat rainbow table attacks. Rainbow tables are precomputed lists of password hashes for common passwords, so an attacker can reverse a hash and discover the original password if no salt is used. Introducing a unique, random salt for each password means the value being hashed is different for every user, even if the passwords are the same. This makes precomputed tables useless, because the attacker would have to generate a separate table for every possible salt, which is extremely costly and impractical. The salt is stored with the hash so the system can verify the password during login.

The other options don’t capture the purpose of salting. Creating a fixed-length output is a property of the hash function itself, not why you add a salt. Salting doesn’t inherently speed up hashing; the goal is not speed but security against precomputed attacks. It also isn’t about integrity or authenticity, which require mechanisms like MACs or digital signatures.