1
$\begingroup$

I have a MD5 hash which is obtained by hashing certain strings appended by a pipe character ( | ). (I know the values of these) A secret key is added as a suffix to this (I don't know the secret key). My question is, is it possible to crack the secret key if the resulting hash and the hash without the secret key is known?

$\endgroup$
3
$\begingroup$

Short answer: No.

Medium-size answer: only brute-force could give you the answer, and that would take as long as the secret part is safe (=long enought)

Long answer: (not so long because it's already said in many good answers at security.stackexchange and here, too. I'll post links later).

Salts are strings appended to another string (passwords) to avoid some leaks and attacks. The salt is know, it doesn't need to be kept secret.

When you say you have a MD5 hash of some know string + secret part, what you are really saying is that you have a hash, you know the salt, and you need to know the password. Knowing all those is not a big deal, it's how hasing salt + password is supposed to work.

So you really have the original problem on "how to know a password if I know the hash?". The special points of your question is that MD5 is used (and is somehow broken, for certain properties), MD5 is too fast to be calculated so many brute-forces attempts can be made per second, and you don't say / know about how many iterations were used.

In the end, you can do some brute-force attack, probably won't be able to use rainbow tables, can use GPUs to speed up the process, but will be doing the old and good brute-force.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.