Lets say I generated a password with really awful entropy seed (5 bits~), but then used another selection process (with a low entropy seed as well) to select at random a method to generate a password (based on the many different methods we see in the wild).

This seems intuitively easy to crack because of the low entropy, but how on earth does a program possible guess at the generation method, if we don't know what that generation method is?

In other words, given a hash+salt can I use some cryptanalysis or other technique to the reduce the scope of the problem without knowledge of underlying dictionary or grammar used to generate the hash.

  • What you describe is somewhat similar to using pepper to make your hashes more resilient to attacks. Just remember that you still need to use salt, and 5 bits of entropy is insufficient regardless of what you do. – kasperd Oct 28 '18 at 9:22
  • Well, if you have a sequence of numbers, say 2, 4, 6, 8, ... can you guess the next one? Actually no, you can't because it's easy to prove that there are infinite answers, but 10 would be the most likely answer for many people. Here it's the same, what could happen is that you have a bunch of pre-made algorithms and try each of these a number of times to see which one looks "reasonable". – ChatterOne Oct 29 '18 at 8:49

In theory, one could make a program that generates lots of password generation algorithms at random (or somehow systematically) and then apply them to a variety of different seeds until it break the code. In practice, this would be very slow depending on the strength and uniqueness of the algorithm. It might be better to get a good cryptanalyst take a look at the passwords and take educated guesses. In general though, you shouldn't depend on obscurity to protect your security.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.