in this post Why can't we reverse hashes? there is an unhash of "Hello World".

How did that work? If there is no function to find it, where does it come from?


1 Answer 1


You misread the question;

First off, I know hashes are 1 way. There are an infinite number of inputs that can result in the same hash output. Why can't we take a hash and convert it to an equivalent string that can be hashed back to the original hash output?

This question is asking about the second pre-image attack. That is given $m$ and hash of it $h = Hash(m)$, find another message $m' \neq m$ such that $h = hash(m')$

For any cryptographic hash functions, including the MD5 and SHA-1 (that their collision resistance is broken) there is no second pre-image attack that is better than the generic one that has $\mathcal{O}(2^n)$-time for a hash function with $n$-bit output.

The example there is pedagogical.

string: "Hello World"
hashed: a591a6d40bf420404a011733cfb7b190d62c65bf0bcda32b57b277d9ad9f146e 

unhash: "rtjwwm689phrw96kvo48rm64unc8oetb5kmrjiuh7h8huhi6dde5n5"
        (a real string that gives the same hash as "Hello World")
hashed: a591a6d40bf420404a011733cfb7b190d62c65bf0bcda32b57b277d9ad9f146e 

The hash function is not defined, it is not a real example, it is given to make the question more clear. If they know such an example, they would be famous!

Read the example as the hash $h$ of $m = \text{Hello World}$ is given then a second pre-image attack is executed to get the string $m' = \text{rt...5n5}$ such that it has the same hash value as $m$; $hash(m) = hash(m')$

  • It turns out the hash function is SHA-256 and actually we have $$hash(m) \neq hash(m')$$

Some note on the terms

The term unhash is a lousy term and it is not a good term in terms of cryptography since we consider that the cryptographic hash functions are one-way functions. Since they are one way how unhash is possible. We rather consider finding a pre-image, that is given a hash value $h$ find a pre-image $m$ from the domain of the hash function such that $h = Hash(m)$.

Most of the websites, that keeps a rainbow table to find a pre-image of predetermined input size and together with hashes of some most common dictionary, use the incorrect terms, like this one;

Reverse md5 lookup, unhash, decrypt and search

  • Hashing is not encryption!

Well, the correct term is to find a pre-image, it is not the pre-image due to the collision, we may not get the original one.

Even the term hash alone is used for a function that scrambles its input or produces scrambled output. For example, we use the term collision-resistant hash function to indicate the aim is collision resistance like SHA-256 and SHA3, Blake2.

There are keyed hash functions like HMAC whose aim is constructing pseudorandom function families (PRFs) or Message Authentication Code (MAC).

  • 2
    $\begingroup$ The hash function in the original question is actually SHA-256, as can be verified by running echo -n "Hello World" |shasum -a256, we get a591a6d40bf420404a011733cfb7b190d62c65bf0bcda32b57b277d9ad9f146e. And once we figure that out we can confirm that the second example is fake; echo -n "rtjwwm689phrw96kvo48rm64unc8oetb5kmrjiuh7h8huhi6dde5n5" |shasum -a 256 gives da0dec1c790d6b6197d906cce98981d60a4dd8c8da430fc71961bafaf2a8891a. $\endgroup$ Commented Nov 17, 2021 at 1:30
  • $\begingroup$ @LuisCasillas thanks. I've never doubted that, you proved that is not real. $\endgroup$
    – kelalaka
    Commented Nov 17, 2021 at 8:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.