First string in hash collisions bucket

Question

My understanding of hashing is conceptual at best and I'm assuming things that I'm not sure of and it leads me to a question that I don't even know if it's founded or not. So please correct my statements below if anything is wrong.

The hash for a given string has a definite length and there is an infinite number of original string that can give the same hash. An example of hashing function I heard of would be modulo 5. So if an user has a password which is 6, then 11, 16, 21 and so on will also log the user in.

I'm assuming (probably wrong though) that practically the strings that give the same hash will be really far apart. Say the original password is :

hunter2

The "second" string that would fall in this bucket would be a bit longer than the entropy of the hash itself. Something like :

LKjsd!sqdJhjsd44qsd5qd5823!é"jsdfhd=qksjdkqsjdkqsjdkquy!erqsdqsdqq

So impractical that the collisions doesn't really matter since nobody would use a password like the second one and let's not even talk about the third collisions .

So my question is :

If the hash can be seen as modulo 5, what stops someone from just saying that if the value in DB is 1 then the most likely value is 6 since 11, 16, etc are impractical ?

Answer 1

There are different kinds of hash functions for different tasks. For hash functions which are used speed up lookups in databases the speed is important and it is usually easy to produce collisions, i.e. different inputs leading to the same outputs. Cryptographic hash functions instead are designed so that collisions are only very hard to found, that means too hard to be found with the computer power available in the next years.

If the hash can be seen as modulo 5 ...

While this might be a simplification usable for simple hashes it does not model cryptographic hash functions. These can more be seen as a kind of function where it is easy to compute the hash value but too hard to find an input which will produce a specific hash value.