Which of the following describes a hash-based birthday attack?

• A. A brute-force attempt to guess a password.
• B. A cryptanalytic attack that exploits hash collisions to find two inputs with the same hash output.
• C. A method to tamper with cookies.
• D. A DDoS technique using SYN floods.

Answer: (B)

The idea being tested is how a hash-based birthday attack works. Hash functions map arbitrary data to fixed-size outputs. If the hash is n bits, there are 2^n possible outputs. Because of the birthday paradox, you don’t need to try all inputs to find a collision; about 2^(n/2) random inputs are enough before you expect two different messages to hash to the same value. The attack explicitly aims to discover two distinct inputs that produce the same hash output, a collision. Once such a pair is found, an attacker can slip one input in place of the other in systems that rely on the hash value (for example, forging a signature or tampering with data where only the hash is checked). This distinguishes it from brute-forcing a password, cookie tampering, or DDoS techniques, which address different security concerns.