0
$\begingroup$

In this question on sha1(known_prefix + user_input + backend_secret), an answer states that is realistically possible to find the first few bytes of backend_secret quicker than brute force.


Changing only user_input, how can I find some information about the constant value of backend_secret?

I give the known prefix of stackexchange, and the backend secret of 107983 (as a string) for this demonstration. You can only change user_input.

user_input="question"

KNOWN_PREFIX="stackexchange"
backend_secret="107983"

# bf24cd561d758104993d3fe6f58b44e6209c7bcd
printf "%s%s%s" "$KNOWN_PREFIX" "$user_input" "$backend_secret" | sha1sum

Excerpts from the answer where I try to follow along:

The probe is obvious, we query for both known_prefix + user_input = A (less the last byte), and known_prefix + user_input = B (less the last byte) [where sha1(A) = sha1(B)].

To do this, SHA-1 would need to already be broken? Is it saying we need to find bf24cd561d758104993d3fe6f58b44e6209c7bxx with sha1(known_prefix + user_input + backend_secret), where xx and user_input can be anything?

If the first byte of backend_secret was the common last byte of A, B, then the results of the two queries are the same (and hence we have learned the first byte of backend_secret)

backend_secret is not known to us, and cannot be changed. The last byte of A and B is the last byte to backend_secret (since sha1(A) = sha1(known_prefix + user_input + backend_secret)). Is the answer saying this can happen if backend_secret is chosen poorly by the backend? Does backend_secret need to be of a specific size?

If they are different, we have learned what the first byte of backend_secret was not (and we can try again with a different collision with a different final last byte).

Since backend_secret is a constant, how can we "try again with a different final last byte"?

$\endgroup$
2
  • $\begingroup$ @kelalaka I want explanation for how to use poncho's answer for the general case. My small secret is only example (6 bytes is not too small, it's already 48 bits - an attacker does not know it is made up of only digits). $\endgroup$
    – wjwrpoyob
    Commented Sep 16, 2023 at 20:50
  • $\begingroup$ You asked, the details, that I gave my time for your understanding, and neither upvoted, nor accepted nor asked still some unclear part. Thank you. Deleted my answer. $\endgroup$
    – kelalaka
    Commented Oct 1, 2023 at 10:48

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.