If someone were to hash the same value with a different salt many times, would it be possible to find the original value?
2
-
1You need to read a little about the properties of a hash function.– MiaoHatolaJul 7, 2017 at 4:20
-
You should probably clarify that you're talking about a cryptographic hash. Irreversibility is not a necessary (or even desirable) property of hash functions in general, and many of them are reversible to differing extents.– Mike ScottJul 7, 2017 at 13:37
Add a comment
|
2 Answers
If the hash size is smaller than the plaintext size, as is usually the case, of course not. No amount of salting can ever restore what is no longer there.
If the two sizes are the same, but the hash function is not bijective, then again it is not always possible. Given that H = h(s?, v1) = h(s?, v2), knowledge of H and s1 will not give the certainty that v1 and not v2 is the value you seek. On the other hand, either value might work as well for your purposes. This phenomenon is kept to a minimum in hash functions because reducing the output space increases the risk of collisions, which is bad.
In the remaining case, when your hash function is actually an encryption, then depending on the salt values yes, this might happen - but the key here is that you would not know. The amount of work required to discover a value s*, such that h(s*, h(s?, v)) gives back v for that specific value of v, is of the same order of magnitude of the brute force discovery of v in the first place, or worse. Basically you have the hash H, and try all possible s*'s until h(s?, h(s*, H)) = H. When you do, then h(s*, H) = v .
There is a last sub-case, when there exists a function g(s?) which will output exactly the desired value of s*. That function is known as a backdoor and a hash function allowing a backdoor is considered badly broken; using this g() it is trivial to invert the hashing.
To make a simplistic example, you will probably know those mind tricks in which you're asked to get your age, multiply by some number, twist the digit in some way, and get a number which is your age "hashed" and has apparently no relation with the original number. Yet the trickster, upon hearing this hash value, is immediately able to get your age back.
No, it should not be possible. A hash function were it would be possible should be considered as broken.
To see why it is not possible, look at how the hash is applied. A common way to do it when you are e.g. hashing password is to XOR the password and the salt. If the salt is random, the value that ends up getting hashed - that is password XOR salt - will be equally random. So having a bunch of them isn't really any help.
