If a password p is selected from a space of 2^64 passwords, and the server stores this as a hash, h = SHA-256(p||s) where s is a random 128-bit salt. How many maximum hashes would an attacker need to perform to recover "p" given (h,s)?
I was thinking that this is a pre-image attack so the attacker needs to find the same hash as the passwords. SHA-256 provides 256 bits of pre-image resistance. So I was thinking the attacker would need in the worst case 2^256 hashes to recover "p".