Say we are given a strong cryptographic hash function hash(), a strong completely random password of 15 characters pass15, two single-character salt values salta, saltb.
We compute the hashes hasha, hashb by applying the hash function to the pass15 password + the salts:
hasha = hash(pass15+salta)
hashb = hash(pass15+saltb)
Now, lets say that salta, saltb, hash(), and hasha are all public. Is hashb any more at risk of being cracked than if hasha was not known?
For those who need specifics, lets go with hash() = sha256, but if it matters please say why it matters to this problem.
My belief is that hashb is no less crackable because only a brute force attack is possible to discover hashb, and that the public knowledge of hasha, salta and saltb has no bearing.
I just do not know if there is some mathematical shortcut that could utilize hasha to speed up the cracking. It does not seem theoretically possible.
**Summary based on responses given so far:**
First, let me rephrase the question in a different way:
If I have a strong, random 15 character password, are the salted hashes completely independent and safe to use however I want, even if the salts are known, are weak single-characters simply appended to the end of the password, and the hash function is fast, such as SHA256?
The answer seems to be yes. So, I could tack on a % character on the end of the password, hash it, and use that hash as my user id. It would be difficult to remember and probably too long as a user id, but it would be safe to do.
I could also tack on a single $ character onto the end of the password, hash it, and use the hash as my laptop password, and it would be safe to do that, even though I am publicly using the % hash as my user id. The list goes on for what I could do with the 15 character password and an appended salt. For example I could tack on the domain name of any site, hash the result, and use the hash as my password to the site.
The last concept is the basis for programs like PwdHash and PasswordMaker.
The assumption has been that (for me at least) the passwords generated by such programs are best kept secret as passwords, lest the hash function somehow gets "broken" or compromised. But it seems that as long as the strong password is kept secret, that any salted hash is individually safe to use however I want - that publishing one such hash to the world in no way jeopardizes the safety of any of the other hashes.
I was simply asking if anyone knows of some weakness with this thinking. The answer so far is no, the individual hashes can be used however I want.
For those who may be wondering about HOW safe, here is a quick math-based answer (I kept the math visible so that you can follow along with your calculator):
I believe that right now some programs can use a computer's graphics card to compute around 1 billon SHA256 hashes per second, 1E9 per second (within an order of magnitude at least).
This is the argument for why SHA256 is poor for passwords, and we SHOULD be using slower hashes such as Bcrypt.
Now, take a 15 character random password. The number of possible candidate passwords given uppercase, lowercase, and numerals in the password would be 62^15 = 7.7E26 possible passwords.
Using SHA256 as the hash function, the number of seconds it would take, on average to crack this password would be half the length of time to enumerate all the possible passwords:
7.7E26/1E9/2 = 7.7E17/2 = 3.9E17 seconds
The number of years to crack the password would be:
3.9E17/60/60/24/365 = 1.2E10 years, or 12 billion years, only a billon years less than the age of the Universe.
So to get from a public SHA256 hash to the original 15 character salted password would likely take more time than I have on this Earth.
Even given improvements in hardware (ignoring the possibility of quantum computers), the gap in technology to get down to cracking it in one year means we need computers that are 10 billion times faster.
So, I should feel free to use SHA256 salted hashes however way I choose as long as the basis of the hash is a random password of 15 characters or more.