14 ms·

In theory, yes, in practice it is fairly obvious how something is hashed just by eye. Different hash algorithms produce different output (lengths, starting char

In theory, yes, in practice it is fairly obvious how something is hashed just by eye. Different hash algorithms produce different output (lengths, starting character, and spread). So with some experience you can often tell (or guess and test) what something is hashed with.

tobyjsullivan 14y ago
I would say that's not really true. The output hash will look the same if I apply a simple salted SHA-1 with a salt or if I apply 500 MD5's followed up followed up with 200 SHA-1's, each salted differently. I'm not a security expert, but I think this is closer to best practice these days. That said, revealing the exact algorithm would basically be throwing people with weak passwords to the wolves while really only supplying the rest of us with a false sense of security (because it will probably be cracked anyway). We'd also be better off if they didn't announce the algorithm if the passwords get leaked (like with LinkedIn).
- gcr 14y ago
  For practice, see if you can't identify the hashing algorithm for the following stored passwords: $6$AhHvI8ay$I0ED2wWVU9eheJKvCxzcbc/ZYRoN60q5XNHruYp8yFlQvEOjJ1WtIHUwjG6L4ZGntf3ei8osB7s2GYdkN01gx1 dGhpcyBpcyBzdHVwaWQKCg== 286755fad04869ca523320acce0dc6a4 some_salt:ac01346ad1553221506dd091800a1974 c8fed00eb2e87f1cee8e90ebbe870c190ac3848c 6b3a55e0261b0304143f805a24924d0c1c44524821305f31d9277843b8a10f4e /5L0cR/wpFqSA Note how they don't look the same, so it's quite easy for an attacker to tell the difference. Want to see how you did? Here's the answer key, in base64: MTogTW9kZXJuIGNyeXB0LCBsaWtlIHRoZSBraW5kIHlvdSdkIGZpbmQgaW4gL2V0Yy9zaGFkb3cK MjogSnVzdCBiYXNlNjRpbmcgdGhlIHJhdyBwYXNzd29yZCAoc3R1cGlkKQozOiBVbnNhbHRlZCBt ZDVzdW0KNDogbWQ1c3VtLCB3aXRoIHNhbHQgcHJlcGVuZGVkCjU6IFVuc2FsdGVkIHNoYTFzdW0K NjogVW5zYWx0ZWQgc2hhMjU2c3VtCjc6IE9sZCBVTklYIGNyeXB0KCk=
reyan 14y ago
The definition of a symmetric cipher requires the cipher text to be (practically) indistinguishable from random. Length is not particularly useful (multiple blocks, different block ciphers with equal block length).
- gcr 14y ago
  Lots of developers who read "Learn PHP in 24 Hours" and similar texts use md5 (32 chars) or sha1 (40 chars). If you're an attacker and see a hex string that's 40 chars long, that gives you a great place to start since you know it's likely to be a naïve SHA1 hash.
  - reyan 14y ago
    If Evernote is not using a key derivation function, I don't know what to say.

tobyjsullivan 14y ago

I would say that's not really true. The output hash will look the same if I apply a simple salted SHA-1 with a salt or if I apply 500 MD5's followed up followed up with 200 SHA-1's, each salted differently. I'm not a security expert, but I think this is closer to best practice these days. That said, revealing the exact algorithm would basically be throwing people with weak passwords to the wolves while really only supplying the rest of us with a false sense of security (because it will probably be cracked anyway). We'd also be better off if they didn't announce the algorithm if the passwords get leaked (like with LinkedIn).

gcr 14y ago
For practice, see if you can't identify the hashing algorithm for the following stored passwords: $6$AhHvI8ay$I0ED2wWVU9eheJKvCxzcbc/ZYRoN60q5XNHruYp8yFlQvEOjJ1WtIHUwjG6L4ZGntf3ei8osB7s2GYdkN01gx1 dGhpcyBpcyBzdHVwaWQKCg== 286755fad04869ca523320acce0dc6a4 some_salt:ac01346ad1553221506dd091800a1974 c8fed00eb2e87f1cee8e90ebbe870c190ac3848c 6b3a55e0261b0304143f805a24924d0c1c44524821305f31d9277843b8a10f4e /5L0cR/wpFqSA Note how they don't look the same, so it's quite easy for an attacker to tell the difference. Want to see how you did? Here's the answer key, in base64: MTogTW9kZXJuIGNyeXB0LCBsaWtlIHRoZSBraW5kIHlvdSdkIGZpbmQgaW4gL2V0Yy9zaGFkb3cK MjogSnVzdCBiYXNlNjRpbmcgdGhlIHJhdyBwYXNzd29yZCAoc3R1cGlkKQozOiBVbnNhbHRlZCBt ZDVzdW0KNDogbWQ1c3VtLCB3aXRoIHNhbHQgcHJlcGVuZGVkCjU6IFVuc2FsdGVkIHNoYTFzdW0K NjogVW5zYWx0ZWQgc2hhMjU2c3VtCjc6IE9sZCBVTklYIGNyeXB0KCk=

reyan 14y ago

The definition of a symmetric cipher requires the cipher text to be (practically) indistinguishable from random. Length is not particularly useful (multiple blocks, different block ciphers with equal block length).

gcr 14y ago
Lots of developers who read "Learn PHP in 24 Hours" and similar texts use md5 (32 chars) or sha1 (40 chars). If you're an attacker and see a hex string that's 40 chars long, that gives you a great place to start since you know it's likely to be a naïve SHA1 hash.
- reyan 14y ago
  If Evernote is not using a key derivation function, I don't know what to say.