Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

I currently am writing a web app and am using two random hashes that are before and after the string and are both 50 char long (alphabet, numbers, and special chars).

strlen($hash1) = 50;
strlen($hash2) = 50;
$sha3pw = sha3($hash1+$password+$hash2);

What are the chances that someone will be able to find a collision from only the hashes? Is there any change or is it a theoretical chance?

share|improve this question
EDITed it, should make things easier to read. –  Benjiii Dec 3 '13 at 9:37
1) There is no SHA-3 yet. Keccak has won the competition, but some details haven't been specified. 2) That depends on the output size, which you didn't specify. A hash outputs bytes, not characters. 3) Don't hash passwords with SHA-3. Use bcrypt, scrypt or PBKDF2 4) collisions have little relevance to password hashing, what matters is one-wayness or first pre-image resistance. –  CodesInChaos Dec 3 '13 at 9:38
@CodesInChaos That would be a nice answer. /* Just saying… ;) */ –  e-sushi Dec 4 '13 at 5:04
As CodesInChaos noted correctly, SHA-3 is not official yet. Keccak (the SHA-3 finalist) has different collision resistances depending on the which one you choose… SHA-3-224, SHA-3-256, SHA-3-384, or SHA-3-512. The 224 bit hash for example currently has a collision resistance of 112 bits, but all that could change if NIST changes things. For details on Keccak and some papers talking about (among other things) it's collision resistance, you could check the Keccak website at keccak.noekeon.org or simply wait for the official specifications which are to be released next year (2014 Q2). –  e-sushi Dec 4 '13 at 5:23
add comment

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.