Wednesday 26 November 2014

The method of a brute

As said before, hashing function are pretty much designed for one way conversion, so reversing it is basically impossible to do. Lets start off by saying that SHA-2 is used mostly in two sources, password and digital signature or check-sums.

In the first case there are two major obstacles in your path, first is getting access to the hash and the salt. These would require you being able to access the server in some way. Next obstacles is to try to create a value that will collide with said hash. This part is where it gets very difficult. This attack is basically a pre-image attack and the time complexity for this is basically the amount of characters that is used to encrypt it. In the case of SHA-2 with digest size of 256 it has a complexity of 2^255 and with digest of 512 for 64 bits it has complexity of 2^511. While it is possible to do it, the amount of time it would take simply be not practical for any purpose.

The second application of this encrypt and validate stored data. The attempt here is to create two similar documents with the same hash. One will be malicious while the other will be non-malicious. The trick is to send the non-malicious document to other party, get their approval(such as signature or agreement to download something), then send the malicious copy to them. Since they have the same hash, one will not know the difference until they open the file or until it has been alerted.


No comments:

Post a Comment