Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

During some of my research work I encountered an unknown hashed string. What I am curious about is the algorithm used to generate it. A factor that makes it interesting - the string contains an asterisk, that acts as some sort of a delimiter. Here is an example:

i6ygOQQhiUbOFeUbzI2L33*cwsrXsCuZu0CQOPhKrZbii8ynu7qx9g

The asterisk does not have a fixed position, so another example of a valid hashed string is this:

NHudTnpSWRDKXAvLwtsAA0HAnCOFe4aLRiL4e8Y5cWYLYVI*hdMRlQ

I ran these values through HashID, but it was not able to identify the algorithm. Any of you security experts ever encountered something like this? Any pointers as to what might be the hashing method?

share|improve this question
1  
I don't know the answer myself, but have you considered that the hash might be homebrewed and not one of the popular hashing algorithms? –  Terry Chia Sep 13 '12 at 2:05
    
The lengths of the hash makes me suspect the same too –  sudhacker Sep 13 '12 at 3:46
    
I was thinking about that and it seems like it is one of the most plausible versions at this point, but I was wondering if maybe I missed something while searching for an existing algorithm to fit this in. –  Den Delimarsky Sep 13 '12 at 4:56
    
Can you add more examples of the hashes? –  Mark Burnett Sep 14 '12 at 0:16
    
Will dump more hashes once I get to the machine, yes. –  Den Delimarsky Sep 14 '12 at 1:16
add comment

1 Answer

up vote 8 down vote accepted

Looks like the first part is a base64'd 128-bit hash, likely MD5, and the second part is a base64'd salt.

In hex:

Hash: 8baca03904218946ce15e51bcc8d8bdf
Salt: 730b2b5ec0ae66ed0240e3e12ab65b8a2f329eeeeac7d8

If you have other examples of the hash, it'd be easy to verify this.

share|improve this answer
    
Nice, I tried to decode base64 from an online calculator, but all I got was garbage. What did you do to get this ? Own script ? –  sudhacker Sep 13 '12 at 13:51
2  
It's base64 of the binary representation of the hash, hence garbage. I just converted base64 to hex and guessed MD5 based on the fact that it's 128-bit. –  Polynomial Sep 13 '12 at 15:04
    
Will try to confirm this once I get to the machine with the hashes. I have a stack of 20+ of them, so hopefully something will come up. –  Den Delimarsky Sep 13 '12 at 16:05
    
It probably isn't true base64 of md5 because you would see an "=" at the end of each code since 128 bits isn't a multiple of 24 bits (3 octets). It's not likely conversion of any real hash due to the variable length. Also, conversion of hex codes to base64 would only contain the characters ABDEFGIJMNOQRTUVWYZcdghijklmwxyz012345. –  Mark Burnett Sep 14 '12 at 1:36
    
It's not ASCII hex to base64, it's raw bytes to base64. The full character set is in effect. –  Polynomial Sep 14 '12 at 6:17
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.