Contents
What do you need to know about salted MD5?
What people call “salted MD5” or “salted SHA-1” are in fact new cryptographic construction, assembling some encoding convention (to transform the password into a sequence of bits) and a salt value (another sequence of characters or bits) into one (or a few) invocations of the hash function.
How to create a list of MD5 hashes?
We will perform a dictionary attack using the rockyou wordlist on a Kali Linux box. To create a list of MD5 hashes, we can use of md5sum command. The full command we want to use is: Here we are piping a password to md5sum so a hash is produced. Unnecessary output is then stripped and it is stored in a file in a file called “hashes”.
What do MD5 and SHA-1 hash functions do?
MD5 and SHA-1 are well-defined hash functions, which take as input a sequence of bits of (almost) arbitrary length, and output a sequence of bits of fixed length (128 and 160 bits, respectively). There is no salt anywhere in the definitions of MD5 and SHA-1; no password either, for that matter.
Is it less secure to use multiple hashes for passwords?
No, multiple hashes are not less secure; they are an essential part of secure password use. Iterating the hash increases the time it takes for an attacker to try each password in their list of candidates. You can easily increase the time it takes to attack a password from hours to years.
How many rounds are there in Salt + hash?
Assume salt is 125 bytes. salt + hash is 1512 bits long, and two SHA-512 rounds (each hashing 1024 bits) will be used by the legitimate user to compute hash = sha512 (salt + hash), rather than one round for hash = sha512 (hash).
Why are MD5 passwords not collision resistant?
MD5 isn’t collision-resistant, meaning an attacker can come up with a password to match any given hash value (whether or not it’s actually the “right” password). The attacker doesn’t care what the value was before you hashed it, including any salting you do; they just need the final value to produce a valid password.