1

Say you have a list of SHA1 hashes which are all encoded with the same salt. All of these are email addresses and you know at least one combination of hash and email address.

Is it possible to use a tool like hashcat to recover the salt and thus decode the entire list?

I have learned that someone has published such a list and my own address is on it. If it's possible to decode that list, I would like to convince them to take it offline. For that I would want to prove to them that even a complete amateur like myself could decode these addresses in a reasonable amount of time, say 72 hours, and with standard hardware like a modern laptop.

Improve this question
1
  • It depends a lot on whether the hash was iterated, and how much entropy the salt contains -- and since salt doesn't need to be memorable or typable, it usually uses either independent bytes or independent chars from a known set (with known size) making the entropy calculation simple. An average GPU today can typically do 1-10G/s of SHA1, so uniterated 64-bit salt would take you on the order of decades, but 128-bit salt would take NSA (or PLA etc) longer than the lifetime of our Sun (and Earth).
    – dave_thompson_085
    Commented Jan 9, 2019 at 4:28

1 Answer 1

Reset to default
1

Finding salt is relatively easy: put the known email address as the salt for the hashes into hashcat. However, it probably won't handle non ASCII salt (e.g. random binary data).

Once you've got the salt, finding predictable email addresses (e.g. [email protected]) is easy enough, but you'd have to brute force both username and domain to find the addresses from a completely unknown space - checking if a given address was present would be easy, but finding all that were present originally is hard. For comparison, even a 12 character random password is hard to break in this way, and most email addresses are longer than that (although they are usually relatively predictable).

That suggests the best way to find out the contents of the list is to find the salt, then hash a list of email addresses to see if there are on the list. Since email addresses are generally not kept private (else it's quite hard to email someone), they are regularly scraped from any databases that get exposed accidentally, and put in big lists on places like paste bin. Unless your email address is only used with trusted contacts, chances are it appears on at least one of these lists already...

Improve this answer
1
  • You can use the --hex-{salt|wordlist|charset} hashcat parameter family to work with non-ASCII inputs (including a binary salt).
    – Royce Williams
    Commented Jan 8, 2019 at 21:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .