hashpasswordsreverse-engineering

Can I determine the hashing-algorithm when knowing salt and plain-text password


I have a database-table of users including columns for password-hash and password-salt. As I am one of the users in this table I also know the plain-text password of one of these users. The salt column is varchar(20) and hash is varchar(64).

I was wondering if it is possible to determine the hashing-algorithm used.


Solution

  • No you can't, because providing one input to two different hash functions can yield the same result.

    Lets say you use a simple integer 8 as an Input for two hashing functions.

    Hash function A could be x mod 2, hash function B could be x mod 4

    8 mod 2 = 0

    8 mod 4 = 0

    As you see, you can easily imagine cases where two hash functions lead to the same result. Even if you consider more complex hash functions this is possible. Also in practice people use multiple different hash functions consecutively on the same input.

    So reverse engineering the hash from Input and Output with certainty is impossible, even when using simple hash functions like this.