At work the hashing algorithm we use for passwords appears to be bespoke. Obviously that's a pretty bad idea, but the management don't seem bothered.
The algorithm always produces 20 character long upper case strings. One particularly worrying aspect of its behaviour is that similar passwords produce similar hashes:
Password2 produce hashes that are different by only about 5 characters.
The other obvious issue is that it doesn't look like the algorithm is deliberately slow, which I'm told good hashing algorithms (
scrypt) should be.
How does one go about evaluating the strength of a hashing algorithm? And what sorts of attacks should we be particularly concerned about with a fast hashing algorithm with poor uniformity?
I have access to the source (although unfortunately I can't post it on a public forum, for obvious reasons).