# Cracking hashes: With vs without knowing the salts

Let's assume the following situation:

The attacker has extracted 1000 password hashes from a website (vuln.com) along with all their usernames and hashing algorithm (assume bcrypt). The only piece of information stopping them from cracking all the hashes is the missing passwords and salts. Assume the salts are all cryptographically random.

What would change if the attacker also has all the salts?

What are the differences between cracking the hashes with and without knowing the salts?

• This looks very much like a homework exercise, but I'm not 100% sure. Could you share some ideas that you have? – DannyNiu Feb 24 '20 at 9:09
• Possible duplicate of Can you help me understand what a cryptographic “salt” is? – kelalaka Feb 24 '20 at 10:56
• This isn't homework actually. I understand what salt and pepper are and how they work. I'm curious about the differences in what it would take to crack hashes with or without the salt known. Without the known salt, it'd be like brute-forcing longer passwords. However, knowing the salt means having part of that longer password known.That much is quite straight-forward. However, that "straight-forward" thing only accounts for simple cases like hash = bcrypt(password + salt) and not other more complicated ways the password and salt can be combined. – John Zhau Feb 24 '20 at 11:12
• Just wondering why this is not asked in Information Security. You cannot brute force if the salt is already around 128-bit and you don't know it. Also, since the collision, you may get a solution but this will not work since you need to work it with the unknown salt. It is not only salt stopping the attacker but also, memory hard hashing like Scrypt. argon2id and passwords genereated from a good entropy source like diceware. – kelalaka Feb 24 '20 at 11:45
• @kelalaka In this case, I'm thinking of using only the brute-force attack. Simple hashes and short salt strings can be assumed to simplify this. An example with pw.len = 6; salt.len = 2 is fine for demonstration purposes. With a few variables (pw.len, salt.len), we can scale it up with longer strings. I'm not very good with maths so I'm wondering how we can estimate computations and whether there's some analysis that can be done knowing the salt but not how the password and salt are combined before the hash. – John Zhau Feb 24 '20 at 13:11