If we know the algorithm used for current day password hashing, how can we not just undo it to get the password?

1.31K views

I have read that SHA-2 is currently unbroken due to the amount of resources and time it would take to crack the hashing, but if we have the step by step algorithm, why can we not just do the steps backwards?

In: Technology

6 Answers

Anonymous 0 Comments

>if we have the step by step algorithm, why can we not just do the steps backwards?

Let me give you an over-simplified example. Here’s my hashing algorithm:

1. Take the password, and replace each letter with a number representing its place in the alphabet. So A=1, B=2, C=3, . . . Z=26.
2. Jam all the numbers together into one long number.
3. If there are not an even number of digits, prepend a zero to the beginning. So 126 would become 0126
4. Group the list into a series of two-digit numbers.
5. Add all the two-digit numbers together.
6. If the resulting number is more than two digits long, go back to step 3. Otherwise, continue.
7. The result is your hash

So if your password is “password”:

1. P=16, A=1, S=19, S=19, W=23, O=15, R=18, D=4
2. 16119192315184
3. *already an even number of digits*
4. 16 + 11 + 91 + 92 + 31 + 51 + 84
5. 376
6. *number is too long, go back to step 3*
3. 0376
4. 03 + 76
5. 79
6. *number is short enough, go to step 7*
7. Your hash is `79`

Now that you’ve seen how this works, your assignment is to take `42` as a hash and reverse the above steps to find out what the original password was. I’ll wait.

.

.

.

Can’t do it, can you? That’s because the above algorithm is a one-way function. It cannot be performed in reverse, because it throws away information. The only way to find out what password results in a hash of `42` is to *try to hash every single possible password* until you find one that gets the results you want.

You are viewing 1 out of 6 answers, click here to view all answers.