1

I'm wondering if there is a faster way than bruteforcing to find the original contents of a string if you have/know:

  • 60 % of the original string (30/50 characters)

  • the amount of characters the string has.

  • know a range of the 8 first possible characters in the hashed string

is it possible to find out what the original string was, or will it not matter how much information you have?

user3499284
  • 113
  • 3
  • you have 60% of the hash or 60% of the plaintext? In all your bullet points, it would be better if you state if they refer to the sha256 hash or the plaintext. – Mindwin Remember Monica Apr 11 '16 at 19:34

1 Answers1

1

Finding the original contents won't be helped if you only have part of the hash value. You still have to try possible input strings until you get lucky, i.e. hit the exact right one. In all generality, you can see it in the following way: if working with a partial hash value helped, then any attack on a full hash value would start by truncating that hash value.

Finding a matching input string, i.e. one that outputs the same partial hash value (but not necessarily the string that was really used in the first place), can be made easier if the target hash output is truncated. For instance, if the SHA-256 output was truncated to, say, 20 bits (out of the original 256 bits), then it is expected that about one string in a million will yield these same 20 bits (because 220 is about one million), so finding a matching input string would only be a matter of trying a million or so inputs, which can be done in a fraction of a second on a common PC. However, if the truncation still leaves 60% of the output, i.e. about 150 bits, then forget it (2150 is way beyond what can be done with existing technology).

Thomas Pornin
  • 326,555
  • 60
  • 792
  • 962