0
$\begingroup$

I have a hash of a file $H_1$ and then I add salt and rehash it: $H_2$. I make my $H_2$ and salt public and I use my $H_1$ as a password. How long would it take for this to be cracked with someone trying to figure out all the combinations of the 128 characters and adding the salt to get $H_2$?

So they are trying to figure out $H_1$ and adding salt to confirm that it matches $H_2$. As $Hash(H_1 \| salt) = H_2$, how long would it take to crack the 128 characters to find the $H_1$ that corresponds with this combination?

Please assume SHA3-512 as hash function.

Improve this question
$\endgroup$
2
  • $\begingroup$ still not clear. 512 bit size of $H_1$ used as a password and 128 characters search? $\endgroup$
    – kelalaka
    Oct 13, 2018 at 21:30
  • 1
    $\begingroup$ @kelalaka I know my askers from stackoverflow, the user means hexadecimals. $\endgroup$
    – Maarten Bodewes ♦
    Oct 13, 2018 at 21:35

1 Answer 1

Reset to default
1
$\begingroup$

A SHA3-512 hash outputs 512 bits. If you use that as input to the second application of the hash then it takes $2^{511}$ tries - on average - to brute force it. This is obviously far out of range of a practical attack.

The one thing that could be performed is to try to guess the input of the first hash: the file content. If this can be guessed then the scheme would be broken. The file could be very short or it may just not contain enough entropy, regardless of the size. For instance, if you'd use the copy of the MP4 version of Kill Bill 1 and somebody knows that you like the movie, the hash may be relatively easy to guess.

Improve this answer
$\endgroup$
7
  • 1
    $\begingroup$ I would try to hack this by looking through the bash history for crypto commands, by the way. Just randomly generating a large enough password using a password manager application may make more sense. $\endgroup$
    – Maarten Bodewes ♦
    Oct 13, 2018 at 21:52
  • $\begingroup$ if you hack the machine install keylogger. $\endgroup$
    – kelalaka
    Oct 13, 2018 at 21:55
  • $\begingroup$ Well its nothing simple that I would be using it would be a Biometric Paramater Hashed along with a salt, this would be ran in a Sandboxed Enviroment so no Keyloggers would be there so no one can try to guess it because it will be salted with 128 characters making it impractical also, the 2511 tries - on average how long is that? if you take a look at this link bitcoin.stackexchange.com/questions/2847/… it says it takes 0.65 billion years to crack a private key, how many years this take and is it quantum resistant? $\endgroup$
    – RebornXD
    Oct 13, 2018 at 22:07
  • $\begingroup$ So my H1 is Biometreic hashed salted and rehashed then I salt H1 and rehash $\endgroup$
    – RebornXD
    Oct 13, 2018 at 22:27
  • $\begingroup$ It is about forever squared (the numbers are simply to ridiculous to represent, it would take all the energy in the universe and then some). And yes, it is quantum resistant, for symmetric algorithms you could halve the security against full fledged quantum computers. However, even 256 bit output would be secure against that (resulting in about 128 bit security). $\endgroup$
    – Maarten Bodewes ♦
    Oct 13, 2018 at 22:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.