3 ms·
You can't reverse most hashes, you can just check if one thing's hash is the same as another thing's hash. If they are, they're probably the same thing.
by skizm 6y ago
You can't reverse most hashes, you can just check if one thing's hash is the same as another thing's hash. If they are, they're probably the same thing.
- aaomidi 6y agoIf you can reverse a hash, its not a hash.
- skizm 6y agoTheoretically, no, but in practice if you know that "password123" hashes to "blaHb1ah" then you get a DB of hashed passwords and see "blaHb1ah", you probably know that person's password is "password123". (which is why you use salts to fix that). For all intents and purposes I just reversed the hash in this context.
- aaomidi 6y agoKinda? But there's infinite number of other things that will hash to that same value. So you can assume (probably with good certainty) that you've got the correct password, but you can't be sure. So pedantically speaking, it's not really reversible.
- zamfi 6y ago> So you can assume (probably with good certainty) that you've got the correct password, but you can't be sure. That's assuming no other constraints. If the constraints on the password are strong enough (for example, must include letters, numbers, special characters, and be less than 30 characters) that there really may be only one input that satisfies those constraints and also hashes to the found value.
- aaomidi 6y ago100% true.
- skykooler 6y agoTrue. However, in most circumstances, finding a input that hashes to that value is equivalent to reversing the hash. For example, if your password is "password", and that hashes to "blahblah", and I find that "foobar" also hashes to "blahblah", then I can log into your account with password "foobar" even though that wasn't your original password.
- oarsinsync 6y ago> However, in most circumstances, finding a input that hashes to that value is equivalent to reversing the hash. In most circumstances, is guessing your smartphone's pin code is equivalent to hacking the security of your phone? In both examples, the end result is the same, but the process is absolutely not. Reversing a hash is a general solution that can be reapplied in all circumstances, much like finding a security exploit to bypass the lockscreen of your phone. Looking up a hash in a rainbow table that matches is much like guessing your PIN. It works for that one specific case. It is not a generalised solution across the board.
- chpmrc 6y agoI appreciate that you specified "pedantically". A whole thread on an inaccurate use of the word "reverse". Oh boy!
- sp332 6y agoThis is true. If a "hash" is reversible, it's actually a cipher.
- crankylinuxuser 6y agoI'd also argue that a hash (SHA, MD5, etc) is also reversible IFF the bit length does not exceed the bitlength of the hash. It's how many a password db is cracked. A hash may have infinite unhashed representations, but if the maxlength (in bits) is less than the hash type, then rainbow tables can relatively easily handle it.
- aaomidi 6y agoNot really, since the hash length is the same. You can end up with infinitely many solutions to a hash, there's no guarantee that the smaller one is the correct one.