0
$\begingroup$

In this question on sha1(known_prefix + user_input + backend_secret), an answer states that is realistically possible to find the first few bytes of backend_secret quicker than brute force.

Changing only user_input, how can I find some information about the constant value of backend_secret?

I give the known prefix of stackexchange, and the backend secret of 107983 (as a string) for this demonstration. You can only change user_input.

user_input="question"

KNOWN_PREFIX="stackexchange"
backend_secret="107983"

# bf24cd561d758104993d3fe6f58b44e6209c7bcd
printf "%s%s%s" "$KNOWN_PREFIX" "$user_input" "$backend_secret" | sha1sum

Excerpts from the answer where I try to follow along:

The probe is obvious, we query for both known_prefix + user_input = A (less the last byte), and known_prefix + user_input = B (less the last byte) [where sha1(A) = sha1(B)].

To do this, SHA-1 would need to already be broken? Is it saying we need to find bf24cd561d758104993d3fe6f58b44e6209c7bxx with sha1(known_prefix + user_input + backend_secret), where xx and user_input can be anything?

If the first byte of backend_secret was the common last byte of A, B, then the results of the two queries are the same (and hence we have learned the first byte of backend_secret)

backend_secret is not known to us, and cannot be changed. The last byte of A and B is the last byte to backend_secret (since sha1(A) = sha1(known_prefix + user_input + backend_secret)). Is the answer saying this can happen if backend_secret is chosen poorly by the backend? Does backend_secret need to be of a specific size?

If they are different, we have learned what the first byte of backend_secret was not (and we can try again with a different collision with a different final last byte).

Since backend_secret is a constant, how can we "try again with a different final last byte"?

Improve this question
$\endgroup$
2
  • $\begingroup$ @kelalaka I want explanation for how to use poncho's answer for the general case. My small secret is only example (6 bytes is not too small, it's already 48 bits - an attacker does not know it is made up of only digits). $\endgroup$
    – wjwrpoyob
    Sep 16 at 20:50
  • $\begingroup$ You asked, the details, that I gave my time for your understanding, and neither upvoted, nor accepted nor asked still some unclear part. Thank you. Deleted my answer. $\endgroup$
    – kelalaka
    Oct 1 at 10:48

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.