If a string has a length of 16 characters, but it is also known that the first 2 characters are fixed, and that the rest of the string has random letters but letters only, no digits nor special chars, would it still take years to crack a sha256 on these conditions or is it unsafe?
-
What you mean with Crack? Finding the password for a given hash that was hashed with a sha algorithm? (Not a good idea). Or find a collision? Or …. ? If it is passwords, sha algorithms are not made for passwords, there made for package consistency, for passwords there with the specialized hardware available really only a matter of a few weeks / months. (Assuming you don’t have a rainbow table).– LvBCommented Jun 3, 2021 at 8:44
-
1You are missing a variable: how many hashes per second that you can perform. Once you have that variable, it's a simple math question.– schroeder ♦Commented Jun 3, 2021 at 9:15
Add a comment
|
2 Answers
The fixed two characters known won't detract or compromise the security of the other 14 characters so let's just look at that that.
Looking at lower case alphanumeric only 26^14 is 6.4509975e+19 which is astronomical and in my opinion safe (this discussion around entropy, or better known as the study of randomness, has lead to the new opinion that long hard to guess passwords built up from phrases is better than 7 characters with numbers and special characters).
If the author want's assurance, you could consider adding a salt. To summarise I don't think these are unsafe conditions :)
-
3It does not say only upper or lower case letters are allowed so it will be 52^14. Assuming it is random, the bit entropy is easy to calculate without using big numbers. log_2(52^14) = 14*log_2(52) = around 80 bits of entropy. Not something I consider secure with a fast hash like sha256 with modern ASICs Commented Jun 3, 2021 at 7:49
-
1@Manish Adhikari - Good point as alphabetic-only is 5.7 bits per character. This means the full 16 characters (if 2 were not fixed) is only 91 bits of entropy. The answer that the other 14 is not compromised by the known 2 is accurate, but the entropy reduction to 80 bits is perhaps more obvious when it's clear that it was never better than 91 bits to start with. Commented Jun 3, 2021 at 16:11
The first two characters are fixed so it does not add or take away from entropy. Assuming that the next 14 letters are random, size of password space = 52^14 (lower and upper case letters). It is equivalent to hashing log(52^14)=14*log(52) = around 80 random bits.
I don't consider it secure against modern ASICs, when bitcoin network crosses 200 Exa hashes per second (about 61 bits). Even if just 10% of this power attacks you, it will only take about two months to crack it (my calculated estimate for maximum time. Average is about 1 month.)
