If I generate an MD5 hash from 2 pieces of information – i.e. by concatenating two strings – how easy is it to guess what that hash is, assuming an attacker has knowledge of only 1 piece of those info?
It all boils down to the amount of entropy in the second string.
How is that second string generated?
If a human generates it, you can be pretty sure that most of the time it will be easy to figure it out. If a computer generates it using a cryptographically strong random number generator, and the string has sufficient length (say more than 80 bits), it will not be feasible for an attacker to guess it.
string1 = "crypto"; string2 = "graphy"; stringToHash = string1 + string2;
MD5-hash of "cryptography":
If the attacker knew either string1 or string2, it would certainly be easier to brute-force it, since you know partial info of the hashed string and therefore you have to try less possibilities.
How much easier would it be?
If we allow the typical upper/lower case letters and digits/symbols, that gives us a set of (26 letters + 10 digits) * 2 cases = 72 characters.
cryptography has 12 letters, so it has 72^12 (19'408'409'961'765'342'806'016) possibilities. But since you know
string2 it reduces the possibilities by that length.
So, i.e. the attacker knows that your input begins with
"crypto" (and knows that the full input has 12 characters): Instead of 72^12, the possibilities now are 72^6.