I found a puzzling site where one puzzle was to find a string whose MD5-hash is given. Is such a puzzles good for learning? I mean, I believe that hash might be cracked by using enough computing resources. You might learn distributed computing or GPU/assembly programming if you try to make a cracker as fast as possible. On the other hand, why should one spend weeks to crack some hashes?
2
-
$\begingroup$ My guess would be that there's a better technique than brute force, especially considering that multiple strings may have the same md5 hash... $\endgroup$– thesecretmaster ♦Dec 21, 2019 at 21:41
-
$\begingroup$ Unless the string is constrained to just a few characters, then you have no chance. There are some weaknesses in md5, but I doubt that they will help to crack an arbitrary hash. $\endgroup$– ctrl-alt-delorJan 7, 2020 at 17:50
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
1
I have used a similar idea - writing an SHA-1 hash cracker - as a mini-project for students learning Java. These students had previously learned to program in other languages, so they had experience with variables, if/else, loops and functions; the main goal was to get them used to Java's syntax, but some of the specific things they had to do were:
- Import and use a library method (
DigestUtils.sha1from the Apache Commons library). - Write a
forloop over a range of characters instead of a range of integers. - Use nested
forloops to generate every combination of characters, of a fixed length. - Use recursion to generate every combination, where the password length is a parameter.
- Estimate how long it would take to crack a password of a particular length by brute force.
- Read from a text file with one word on each line.
- Test their code.
Your question implies you are thinking of writing your own implementation of the hash function itself. I think that's probably less worthwhile, since you'll just be directly translating from the hash function's specification into code, or from an implementation in one programming language to another. You would be practicing your skills in reading and making sense of specifications or code, and you might learn some things about bitwise operators; but the design of a hash function is arbitrary and opaque to almost everybody, and there would not be much real "problem solving" required.
I think for a learner-programmer, there is more to gain from using a library for the actual hash function, and writing the rest of the cracking program yourself - i.e. the part which generates the candidate passwords to feed into the hash function. For example, the next mini-project I got those students to do involved generating all combinations of playing cards to work out probabilities of winning in a simple card game; this is not entirely unlike generating combinations of characters for a password, and some students did notice the similarity.
-
2