4

If the salt in the hash is known to us, then is it possible to crack to extract the password from the hash? If yes, how?

7

Hash functions are designed to go only one way. If you have a password, you can easily turn it into a hash, but if you have the hash, the only way to get the original password back is by brute force, trying all possible passwords to find one that would generate the hash that you have. Assuming the salt is very long, not knowing the salt would make it nearly impossible to crack (due to the additional length that the salt adds to the password), but you still have to brute force even if you do know the salt.

As an example, let's say that the password is "secret" and the salt is "535743". If the salt is simply appended to the end of the password, then the hash you'd be cracking would be a hash of the string "secret535743". Without knowing the hash, you'd have to try all possibilities until you reach "secret535743", which would take quite a while due to its length (keeping in mind that real salts are much longer than this).

But if you know that the salt is 535743 and that it is appended to the end of the password, then instead of trying everything, you'd try "a535743", "b535743", "c535743", etc. This greatly reduces the number of possibilities you have to try until you reach the correct string.

With that being said, it is generally quite rare to have a situation where you know the hash but not the salt since both are usually stored in the same place.

  • You state that this can be done only by a brute force attack, this is technically wrong. A brute force attack should be used as a last resort when a dictionary and/or hybrid attack does not give the wanted result. – Jeroen - IT Nerdbox May 7 '15 at 18:14
  • @Jeroen-ITNerdbox I always thought dictionary attacks were a type of bruit force attack. the only difference is the order of the attempted inputs. Am i wrong with this thinking? – Topher Brink Jan 16 '17 at 17:23
  • @TopherBrink Technically a brute force attack is trying every password possible. So if we know the length is 6 characters, we try 'aaaaaa', 'aaaaab', etc. etc. Whereas a dictionary is trying words found in a dictionary, combined or not. Or a hybrid, adding random stuff to words from a dictionary. – Ryan Kelso Jan 16 '17 at 20:29
  • @tlng05 how do I determine the algorithm of an password hash ? I have hundreds of hashed passwords which are 8 in character length, but I couldn't find the algo to it. – turmuka Dec 1 '18 at 16:15
1

If you know how the salt is used when hashing the clear text phrase this only makes it easier to brute force. The number of possibilities you have to check will be going dramatically down, since you only have to check for the phrase without the salt. Still if it is a long phrase with many different characters it will take a lot of time.

  • 2
    The salt is usually published and not a secret so it has no impact on the brute force difficulty. It does mean you can't resort to a precomplied rainbow table and there lies its value. – zedman9991 May 7 '15 at 20:50
-1

When password is not salted, and for example function md5 is used, then a potential hacker can go to online databases, and just a lookup there for a right password.

When password is salted, then one must brute force it, which is very time consuming. If attacker do not know salt, then in practice it's impossible to hack it at all.

  • 1
    Welcome to Information Security Stack Exchange! Unfortunately, this barely answers the question; it says that if the salt is known, brute-forcing is very time-consuming. However, if you check the other answers, you'll find that this is an over-simplification. Without further elaboration (preferably including the entropy calculation and a hash function that hasn't been broken yet), I'm afraid this answer is not up to the standard of this site. – S.L. Barth Jan 16 '17 at 12:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.