1

How can I indentify a hash? Not with length only, I mean: as I know, specific hashes has specific charsets. Where can I find them? I need this information for making a hash indentification tool. (this is an a unique post, the another one wasn't fully answered).

8
  • 2
    This question already has a lot of close votes, but I actually think it's good. We do get a lot of "What kind of hash is this?" questions, and it would be nice to have a general question to link people to.
    – tim
    Jun 18, 2015 at 17:47
  • @tim like this one? : security.stackexchange.com/questions/63526/…
    – schroeder
    Jun 18, 2015 at 20:39
  • You see, I am coding my own tool :) Jun 18, 2015 at 20:43
  • @schroeder yes, like that. But I think that this question is more general (although the answers sorta fit here, although I think a nice list of common hashes + length + char set would be nice, instead of a link list which will result in dead links; an answer could also point out that you can't know the algo by looking at the hash, which would be interesting). And sure, google would probably answer the question. But google would answer a lot of questions in the SE network; for me, that's not a reason to close a question. But I do kinda see why some would want to close this question as too broad
    – tim
    Jun 18, 2015 at 20:52
  • 1
    @ViliusPovilaika the specific charsets for each hash will be found in the definition of each hash you want to inspect. That's a research question for yourself and too broad to answer here. The hash definition will also describe the lengths that are valid.
    – schroeder
    Jun 18, 2015 at 21:11

3 Answers 3

2

There is a difference between a hash as defined for a specific protocol and a cryptographic hash. A cryptographic hash simply takes a message of x bits and outputs n bits where x can be any positive number or zero and n is the output size of the hash. So in that sense a cryptographic hash doesn't define any encoding. A cryptographic hash is indistinguishable from random to a person that doesn't know the input (apart from the output size). So you cannot distinguish between SHA-256(x) and SHA-512/256(x) without knowing x.

A hash can however be encoded together with various parameters, especially if it is actually a password hash (which actually is a PBKDF or password based key derivation function). In that case it depends on the protocol that generates the hash. This is what sites like the one pointed out by User456 show. These values should only be interpreted for those specific protocols. These protocols however have not been designed from a common specification; the protocols do not have to adhere to any rules. Output of these protocols may very well overlap.

So the only way to say which encoded hash is for a specific protocol is to compare the encoded hash against the format defined by the protocol. Regular expressions could be used to filter out candidates. You should expect a mix of hexadecimals, base 64, decimal numbers and of course separator characters for most of them.

4
  • Thank you for your explanation! Now with knowing more about hashes I can research manially! Jun 18, 2015 at 21:44
  • You're welcome. I hope I made the distinction between a cryptographic hash and an encoded hash of a protocol clear enough. Jun 18, 2015 at 21:46
  • You really did :) Jun 18, 2015 at 21:46
  • Small side note: sometimes only y bits are used of the full output size of a hash or HMAC. These are also indistinguishable from random (so 160 bits taken from SHA-256 cannot be distinguished from a full SHA-1). So output size in bits in itself may still not give that much of a hint. Jun 18, 2015 at 21:53
1

The short of it is that you can't.

Hashes don't output encoded characters. They output bytes, and a good hash function should appear to generate all of its output bytes at random.

Often, hash outputs are later encoded for humans to read or for compatibility; for example, as hex or base64. But any data can be encoded this way, and there is no way to distinguish the output of a hash.

If you see 256 bits of seemingly random data, it could be a hash (e.g.,, SHA-256 or BLAKE2b/256), 128 to 255 bits of data encrypted with a 128-bit block cipher (e.g., AES-CBC), 256 bits of data encrypted with a stream cipher (e.g., AES-CTR), purely random data (e.g., output from /dev/random), output from a DRBG (e.g., the Yarrow CSPRNG), or any of a number of other possibilities. The only way to know for sure is through context.

4
  • Thank you for the answer, but I am making a tool that doesn't see the context :) Jun 18, 2015 at 21:46
  • Then you simply cannot accomplish that which you are trying to do. Jun 18, 2015 at 21:47
  • Well, at least there's a range of possible hashes :) Jun 18, 2015 at 21:49
  • Only if you are certain that the input is a hash; and then, the best you can do is take a guess based on length. A 256-bit input could be two MD5 hashes, SHA-256, SHA-512-256, BLAKE2b/256, CRC32, GOST, Skein, an HMAC of any of those, etc. Jun 18, 2015 at 21:53
0

Take a look at the following page:
http://hashcat.net/wiki/doku.php?id=example_hashes

It will provide you with some examples of hashes. You can use tools like hashid or hash-identifier to help try to identify various hashes (both are included with Kali if you are up for spinning up a Linux VM). The tricky part, as I recently went through, is that sometimes it is a hash and sometimes it is an encrypted password or hash. Or other times it is a base64 encoded hash, so you would first need to decode it and then identify the hash. And so on such that what looks like a hash may not be just a hash.

So in some cases, identifying the hash is more difficult than others (at least in my novice estimation, others here may be able to provide better insights).

1
  • Thank you for the answer. But how about specific symbols or charsets that are only used in hashes? Where can I find them? Jun 18, 2015 at 20:35

Not the answer you're looking for? Browse other questions tagged .