An attacker want's access to a specific account, he doesn't know the password.
- It's a high entropy password. +128bits
- The attacker has the hash for the password (Assuming OWASP suggested bcrypt with cost 12)
- The attacker has a list with n hashes that HE KNOWS are hashes for the same password he is looking for. (He magically knows, just bear with me)
Does the list of hashes makes it easier for the attacker to gain access to the password? (Either by guessing the password of finding a collision) Or is the difficulty the same as if he had a single hash?
I'm aware it's an unlikely scenario, I'm just trying to understand more about the risks of exposed hashes.
I have very little understanding of InfoSec and hash functions, but it seems to me that the hash list makes no difference for trying to crack the password, but it could improve the chances for the attacker to find a collision. If my assumption is correct, how large would the list have to be, for it to become a realistic problem? (Ballpark estimates are fine)