00:00

#0701

Weak Hash Algorithm

Easy+50 XPA07:2021 Identification and Authentication FailuresCWE-916
Password HashingWeak AlgorithmMD5

Scenario

A user authentication service stores passwords using a hashing function. The developer chose MD5 for its speed — not realising that speed is exactly what makes it dangerous for password storage.

MD5 produces hashes that can be cracked in seconds with modern GPUs and rainbow tables. Billions of MD5-hashed passwords have already been dumped in public breach databases.

The hashPassword function must be updated to use a modern, slow hashing algorithm like bcrypt that is specifically designed to resist brute-force attacks.

MD5 was never designed for password hashing. A modern GPU can compute billions of MD5 hashes per second, making brute-force trivial. Algorithms like bcrypt, scrypt, and Argon2 are intentionally slow and include a cost factor that scales with hardware improvements.

Your Tasks

  1. Fix hashPassword so that the returned object's algorithm field is "bcrypt" instead of "md5".
  2. The hash field should still contain the (simulated) hashed password value.
  3. Do not change the function signature.

Examples

Example 1Vulnerable — uses MD5

hashPassword('hunter2')
// → { algorithm: 'md5', hash: 'hunter2' }

Example 2Fixed — uses bcrypt

hashPassword('hunter2')
// → { algorithm: 'bcrypt', hash: 'hunter2' }

Constraints

  • Return an object with shape { algorithm: string, hash: string }.
  • The algorithm field must be exactly "bcrypt" after the fix.
  • No external packages — hashing is simulated as a pure string operation.

Hint

References

solution.js
Ln 1, Col 1UTF-8JavaScript
Sandbox ready
0/0/0not run