I have and android app that sends a encrypted sha1 salted message to a server, I know the message, is it possible to find the salt or it would be easier to try to reverse te android app?
2
-
When you say an encrypted message, I assume you mean a hashed password, right? If it is hashed, the person on the other end wouldn't be able to extract the plaintext if it is really a "message."– GrayCommented Feb 27, 2014 at 18:20
-
@Gray The message I send to the server is. My message in plain text + my message sha1 encrypted and salted. The encrypted part of my message is just to check that the request was made by the app. So the server receives my message in plaintext and sha1 encrypt and salt it to chechk if the hash matches with the hash sent– AmanCommented Feb 27, 2014 at 19:41
Add a comment
|
1 Answer
Please do not say "sha1 encrypt", SHA1 is for hashing, not encryption. With the scenario you describe in comment, what you are looking for is a MAC, for example HMAC-SHA1. This allows the server to check the integrity of the message as well as its authenticity. It uses a shared private key. Your scheme with just SHA1 + salt is not secure, someone can change the message and recompute the hash on the fly.
Rereading the question I understand it is not your app. So either they simply use a SHA1 like you describe and it only checks for integrity, not origin, or (hopefully) they use an HMAC, and that involves a secret key that is hidden inside the app. (It is not merely a "salt"). In that case, no, you cannot recover the secret key from the plaintext message and the HMAC alone.
-
Thanks, it is like I thought and the key was inside the app! All good now!– AmanCommented Feb 27, 2014 at 22:15