1

This is a theoretical question about hashes, where I would want to know if the hash(“XY”) would be at risk if I revealed ‘X’. Where X can be a substring. Considering the most perfect hashing algorithm (theoretically speaking).

  • It depends. If x is a 20 character string and y is a 1 character string then you have a problem. If x is a 1 character string and y is 99 characters then you are fine. – Conor Mancone Feb 27 at 2:53
  • @ConorMancone Then, is this because chances of guessing the original string increases ? I understand that having only one char is more guessable, but I was looking for a stronger security concept (just if there exists). Nice contribution btw. – J. Francis Feb 27 at 4:35
  • you describe a salt, a known salt. look into that to help understand the benefits and risks. – dandavis Feb 27 at 19:07
3

For a perfect hashing algorithm there is absolutely no correlation between the input and an output. Any change in input has a 50% chance of flipping each bit in the hash. This means that information about any partial part of the plain text leaves no way to guess what the rest of the plain text is. Even if you have a 500 character string and know the first 499 characters, nothing about the hash will help you determine what the last character is.

Therefore, for a perfect hash, the only way to guess the plain-text is by brute-force. Of course it's worth a mention that brute force doesn't guarantee that you find the original text - only something that hashes to the same hash. This is a result of the pigeonhole principle. This often doesn't matter though. For instance if you are trying to crack a password, you don't usually need to know the actual password, since any string that generates the same hash as the password will still allow you to login as the user.

Therefore, knowing part of the original text makes brute force easier. Brute forcing a 10,000 character string hashed with SHA256 is effectively impossible. However, it's obviously much easier if you know the first 9,999 characters, since you only need to brute force the last one.

| improve this answer | |
  • Nice work! Thank you for the time – J. Francis Feb 28 at 2:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.