# How fast can SHA-1 be brute forced when used with a secret?

In my code I calculate hashes for known codes and a secret with SHA-1:

``````SHA-1(code + secret) = hash
``````

A attacker can do statistical analysis on the database and for example guess that the code `03220` produces a specific output.

``````SHA-1(03220 + secret) = f24647f6573032838969db0934c63f6aa99c6173
``````

The secret is 120 Bit long and for example `Wqj5ASoan1iCjnjLeO6fL`.

My question is how long it would take for an attacker to brute force the secret, when he knows the used code and output of the hash? Is it secure?

It is possible to brute-force with 7 Giga SHA1 per second on a good system. When we assume that your "secret" is indeed randomly generated (as it looks like) and is 120 bits long, we can guess the necessary time to find a match:

``````  possibleCombinations = 2 ^ bitsOfPassword
expectedTimeInSeconds = (possibleCombinations / triesPerSecond) / 2
``````

This makes about 3E18 years, so brute-forcing is clearly out of question. As mentioned, this only applies for really random "secrets". If only the SHA1 hashes are stored in the database, there should be no way to guess the "key".

I wonder what your intention is although, there are better ways to combine a key with a token (HMAC), or is it used in the context of password storage?

• Hi @martinstoeckli thanks for this great answer! I do not store passwords. I have a database where the stored information needs to be hidden but also searchable. Using AES-GCM encryption was no option because it generates different encrypted data. Using SHA-1 I get the same hashed data for the same input, it allows me to perform search on the database. My main concern in this question was if the `secret` can be guessed from the hashes? For me it is really important that the `secret` stays secret, because its also used as key for encrypting more confidential data. What`s your opinion on this? – John Smith Oct 18 '16 at 22:21
• @JohnSmith - The secret cannot be guessed from the hashes, SHA* is designed in a way, that does not allow conclusions about the original content or about similarities to other content. As mentioned, your problem is a good case for a HMAC, whose job is to bring a key into the hashing. Using a second independend key is surely not a bad idea, maybe you want to share it with more people than the first important key, but i cannot see a security problem in using the same key (keep in mind that I'm not a cryptographer). – martinstoeckli Oct 19 '16 at 6:16