1
$\begingroup$

I have a plaintext and a hash output, two hash outputs to be precise. One is HEX encoded, and I have no idea on the other one.

plaintext=halflife

hash=1e4dfacf77efceb3076bb551932e6e40

hash2=PN[6O265X^W6YEIK`/YJNVX54N\HY

I can't be actually sure which hash is output derived from my plaintext, and which isn't. Is there a tool I could use to figure out how was my plaintext hashed, so it would come out like this? If not, what procedures would you recommend?

UPDATE: I now know that the hash2 is actually not the hash of the plaintext, but something else. I also know that if I change the plaintext > hash gets updated, and if I change hash back to it's original state > original plaintext is considered correct.

Improve this question
$\endgroup$
10
  • $\begingroup$ You are right in saying that you cannot determine which one is derived from your plain text this is a feature of hashing algorithms called preimage resistance where given the hash it is hard to determine the original text. $\endgroup$
    – Nat
    Commented Feb 19, 2017 at 12:09
  • 1
    $\begingroup$ @Nat That's not what preimage resistance means. $\endgroup$
    – fkraiem
    Commented Feb 19, 2017 at 12:23
  • $\begingroup$ @fkraiem For a given h in the output space of the hash function, it is hard to find any message x with H(x)=h. $\endgroup$
    – Nat
    Commented Feb 19, 2017 at 12:25
  • $\begingroup$ ... when given only h and nothing else. $\endgroup$
    – fkraiem
    Commented Feb 19, 2017 at 12:28
  • $\begingroup$ Besides, preimage resistance also assumes the algorithm is known. $\endgroup$
    – fkraiem
    Commented Feb 19, 2017 at 12:30

1 Answer 1

Reset to default
1
$\begingroup$

I just tried this tool to no avail

https://www.onlinehashcrack.com/hash-generator.php#res

My best guess is that the program is actually doing more than a simple hash, it may be a number of hash rounds or some other manipulations

You said that changing the plaintext makes the hash change. So you have a program which performs such unknown hash. Decompile it and work out the process behind. The algorithm is not "secret", it's stored in the executable

Improve this answer
$\endgroup$
2
  • $\begingroup$ The thought had crossed my mind. Any ideas, based on the hash length, etc? $\endgroup$
    – Jan Novák
    Commented Feb 19, 2017 at 12:49
  • $\begingroup$ the hash is 16 bytes long (128 bits) so it may be a final stage of MD5, MD2 or RIPEMD-128. Hash length doesn't give you any hints on the actual algorithm behind. As I said, decompile the program and have a look, that's the best you can do $\endgroup$
    – Gianluca Ghettini
    Commented Feb 19, 2017 at 12:56

Not the answer you're looking for? Browse other questions tagged or ask your own question.