# How many hashes to recover a salted password? [closed]

If a password p is selected from a space of 2^64 passwords, and the server stores this as a hash, h = SHA-256(p||s) where s is a random 128-bit salt. How many maximum hashes would an attacker need to perform to recover "p" given (h,s)?

I was thinking that this is a pre-image attack so the attacker needs to find the same hash as the passwords. SHA-256 provides 256 bits of pre-image resistance. So I was thinking the attacker would need in the worst case 2^256 hashes to recover "p".

• This is not a collision attack, since the attacker is not allowed to freely choose the two colliding outputs. Instead, there a strategy that always finishes with at least one guess Nov 17, 2022 at 0:06
• Consider 1) what is the answer if there is no salt and 2) how does adding salt change the answer? Nov 17, 2022 at 0:56
• Oh, so it's actually a pre-image attack. Nov 17, 2022 at 3:11
• This is closed as homework. It's an easy one. Hint: often the best strategy to find a password (password cracking) is to try all passwords (in practice, about from most to least common, but that refinement is not in this problem). What's needed for this?
– fgrieu
Nov 17, 2022 at 7:47