is it easier to get the original password if you have multiple hashes of it?

Question

Most users tipically use the same password for multiple applications. Let's say all of these applications hash the password in some way. Would it be easier for an attacker to get the original password if it got access to all the different hashes? Of course the attacker probably looking at the hashes may know which is the weaker one and only try to bruteforce this, but has he gained anything having access to other hashes of the same password? Also assuming the attacker does not have any rainbow table containing any of these hashes.

So, if an attacker has access to all these hashes of the same password, can he be faster in breaking it than just try to bruteforce one of the md5 hashes (as in this case is the weaker link)?

• 33c38d9db9759da0d0a813968bc3c1fb
• 7b8758cf3cb6e540d60b3e9999c48fbef0502ac6
• faa81286aa90907253a58acfd83d2d89e58120031630d60dc05d0cd365b6df8d
• $1$NPeNiNCA$AwpOWKuur2LZvXiJxNM6U1
• $5$VHVZwDnI4aAEUG2m$ZhSJ537JmYJ5ISDxPQ6doWxPOrz9AMjyvxYxecViK23
• $5$3bRXBWCpG9GEHdm$a2xIBbgK.fyr5k26BhUGo2QCvl25yQU1I9mwFp7mmh5p
• $6$Hcdqud1hDgz$5MOEbgtOdxfF289OSXrmIevt7NnZBLaQkNGKeijR/X09ZDEbQ/ZfObJjNo0J64t4haSSqihRhfPe4z8l.ptro1
• $6$hqaQ3RzX$bk8dgMsAlmDPpOX0IWWIrJ9T3awblvI.PCipeqJDdJZSVDQJgCRsQRX8pKpFU2XNcvRr56e3MARcTQR5oJ94V/
• $2a$13$Hdz8T8vlEqwCvhixyu4rlel2cjj.TfA1qXEZ2dXhabogN35Idd8Je
• $2a$15$hLPoYhbVJNA48A/Wmv1I5.5XBv/G/1s8BGfDLU7mt37ojGhNjETd2

btw, the original password is hello12345world12345, I'm not trying to (make you) crack someone's password ;-)

Answer 1

In theory, having several hashes may help; in practice, not so much.

The Theory

Let's consider SHA-256. From this function, we can define another hash function, which we will call SHB-256, such that SHB-256(m) = SHA-256(m) XOR m. In simple words, I compute the XOR of the SHA-256 and the first 256 bits of m.

This "SHB-256" is as good a cryptographic hash function as SHA-256: it is similarly resistant to collisions, preimages and second preimages. However, if I give you both SHA-256(m) and SHB-256(m), then a simple XOR of both value will yield the first 256 bits of m.

The Practice

Taking advantage of several hashes computed with the same password then relies on how "similar" the hash functions are, so as to allow "canceling" each other. This is a very ill-defined property, and (as yet) not thoroughly investigated. To my knowledge, no such shortcut is known with existing hash functions. There are a lot of details to mind; iterated functions and usage of salts make the matter even more complex.

What a realistic attacker can do when faced with multiple hashes is to use the one which will be easiest for him to attack, and ignore the others. If one of them is unsalted, then the attacker will target that one, which allows for simultaneous attack of several hashed passwords and usage of precomputed (rainbow) tables. Otherwise, he will use the function which will be most efficient when implemented on his hardware (e.g. if faced with PBKDF2 and Bcrypt, the attacker will target PBKDF2, which is easier to implement on a GPU). As @Polynomial puts it, your hashes will be as strong as the weakest of them.

An extra indirect effect is about your CPU budget. When doing registration, you will hash the user's password with all the hash functions. For the hash functions which are "configurably slow", like bcrypt or PBKDF2, this may incite you to configure them to be "a bit faster" than what you would have done if you had used only one, so as to keep your own costs within tolerable limits. This correspondingly lowers the attacker's efforts, since he has just to crack one hashes, not all of them.

Answer 2

It depends on your password strength and hashing algorithm used for hashing. There are programs uses CPU + GPU to break the hashes using brute force attacks. So if you use common password its easy to crack by using a PC and a graphics card. There are lot of applications available which uses the power of GPU along with CPU. It's not matter if you give two or three types of hashes of a password, the brute force timing is depends on password strength and the hashing algorithm.

If I have 5 different hashes of your password and one of them is very weak, then that password can be recovered quickly by attacking the hash of weakest hashing algorithm.