5

Given the input:

test

A system generates the following output hash:

0x001F41B6A0534D3B851D69EFE6237F550100000010D5F4FC65E64BCFDBF2590212E4411C44942C6C734C00ACFE13B958DCAB3614

I do not know the algorithm, or what salt (if any) is being used. However, I can feed the system any input I choose, and receive a hash in return.

Given the above, is there a way I can determine which hashing algorithm is in use? Could I also find out if a salt is being used and, if so, what it is?

Improve this question
6
  • Where did this hash come from? It doesn't look like a pure cryptographic hash - too many 00 pairs. Without knowing more, this is impossible. Besides, we don't tend to accept questions like this on StackExchange - we have guidelines about question quality and this would fall under "too localised" and "not a real question" - see the FAQ for details.
    – Polynomial
    Feb 5, 2013 at 16:21
  • Have you by any chance omitted some characters from the hash (like ":") ?
    – Dinu
    Feb 5, 2013 at 16:28
  • 1
    Scratch that - on second thoughts your question is quite interesting. Since you have the ability to ask the system to hash any arbitrary message, it may be possible to recover the mechanism. I don't see it being trivial though. Depends how much more information we have.
    – Polynomial
    Feb 5, 2013 at 16:29
  • @Nontenda, can you give more examples of input and output?
    – Cristian Dobre
    Feb 5, 2013 at 16:48
  • Dinu S : No, this is all the string.
    – Nontenda
    Feb 5, 2013 at 16:50

3 Answers 3

Reset to default
10

To find out if a salt is used, try to use the hash the same value again (as if it was a "new password"). If you get a distinct output, then there is some non-determinism (aka "a salt"); otherwise, there is no salt.

If the hashing mechanism is meant to be secret, and was done properly, then it is a MAC and you will not be able to rebuild it from analysis of inputs and outputs alone. If it was not done properly, then... anything goes.

Improve this answer
8
  • 2
    @almathie That isn't true. When the salt is secret and static, it is no longer a salt; it is the key for a MAC.
    – Polynomial
    Feb 5, 2013 at 17:03
  • 1
    Indeed, "test" twice does not result in the same hash. So I suppose it will be very difficult to find the way it is encrypted ?
    – Nontenda
    Feb 5, 2013 at 20:53
  • 1
    @Nontenda: this will be hard, unless you resort to the usual method called "reverse engineering": grab the code for the server and see what's in it. Alternatively, offer two pints of Guinness to the developer and he will tell you everything there is to know about the system.
    – Thomas Pornin
    Feb 5, 2013 at 20:58
  • 3
    @Nontenda: as a wild guess, the string is some encoding which begins with the salt, and ends with the hash value, with some glue between the two (for at least the three '00' bytes in the middle). The hash value would then have length 32 bytes, which makes SHA-256 a plausible hash function. Then it depends on how the salt and input string are mixed together in the hash function input, and the number of possible combinations is high. Also, there could be several (possibly many) nested hash function invocations (as a "slowdown" feature, which is desirable when hashing passwords).
    – Thomas Pornin
    Feb 5, 2013 at 21:30
  • 1
    Security through obscurity is an anti-requirement. Encourage the developer or company to open their methodology to analysis and comment. After the Guinness.
    – Andrew Philips
    Nov 12, 2015 at 1:43
0

I do not think you can. Hashing destroys information. You also will not be able to determine details like the number of rounds and feedback...

Improve this answer
0

The only data we have to work with is:

  • input data and length
  • output data and length

Conceptually the output data itself should provide no information since cryptographic hash algorithms are not meant to convey information in their output.

The only bit of information that's useful here is the length of the output data which is 105 hex digits indicating the output is 840 bits.

If you can determine the algorithm used you might have a small change of determining if the data was salted, otherwise there's no chance.

Here's a list of cryptographic hashing algorithms and their matching output size, none is 840 bits long.

I'll echo some of the comments, this doesn't look like the output of a cryptographic hashing algorithm, rather encoded data. The data after the 10000001 sequence is 64 bytes, that is characteristic of many hashing algorithms, namely SHA-512.

Improve this answer
1
  • Wild guess: it may return the concatenation of the hash and the random salt.
    – borjab
    Jan 20, 2016 at 14:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .