Assume I have a password that is exactly 32 characters long. I hash it the following way:
- Prepend 1524 bytes (known to an attacker)
- Append 3356 bytes (known to an attacker)
- Do the checksum
It is clearly visible that only a tiny part of the plaintext is variable.
Assume the attacker stole the checksum from a DB. How difficult would it be for them to recover the password or create a collision? What checksum algorithms are more resistant against that?
Yes, I know that one cannot recover a password from a 16-bit CRC-16. Let's assume that the checksum is at least 128 bits long.
What would change if one of pads would disappear?