If I generate 128 bit, 512 bit and 1024 bit random strings using either:
- A native rand() function (C, PHP, Python, etc)
- OpenSSL random bytes
- Hardware generated random number
And hash the random string using one of these hashes:
How long will it take for someone to find the random string from the hashed result?
128, 512, 1024 bit strings generated from a native rand() using any hash will be very insecure. Since someone can just find the seed and begin generating the random strings. Irregardless of the hash, meaning no bruteforce is needed.
But with OpenSSL and HRNG, I would expect it to take much longer. How long would this take? Would this still be the case if MD5 or SHA1?
And why would it be a bad idea to use these strings as a salt?