Discover private key with value and hashed value?
-
Is it possible to discover the private key used in a hash algorithm if you have both a clear text value and it's hashed equivelent?
Mark's blog: developMENTALmadness.blogspot.com
-
Is it possible to discover the private key used in a hash algorithm if you have both a clear text value and it's hashed equivelent?
Mark's blog: developMENTALmadness.blogspot.com
Probably with a PhD in Mathematics and whole lot of computing power, yes. Can it be brute forced? Yep, given sufficient time, anything can be guessed at until you get it right. Can some schmuck off the street discover it, no.
A guide to posting questions on CodeProject[^]
Dave Kreskowiak Microsoft MVP Visual Developer - Visual Basic
2006, 2007, 2008 -
Probably with a PhD in Mathematics and whole lot of computing power, yes. Can it be brute forced? Yep, given sufficient time, anything can be guessed at until you get it right. Can some schmuck off the street discover it, no.
A guide to posting questions on CodeProject[^]
Dave Kreskowiak Microsoft MVP Visual Developer - Visual Basic
2006, 2007, 2008Great, what I wanted to do was create a confirmation email. The link to confirm would include the email address to be confirmed in plain text, and a hashed version of the same email address. So when the email is confirmed I can hash the plain text and compare the two values to make sure it hasn't been tampered with. But I wasn't sure if it was possible to reverse engineer the private key and regenerate the hash value so it would match and bypass the validation.
Mark's blog: developMENTALmadness.blogspot.com
-
Great, what I wanted to do was create a confirmation email. The link to confirm would include the email address to be confirmed in plain text, and a hashed version of the same email address. So when the email is confirmed I can hash the plain text and compare the two values to make sure it hasn't been tampered with. But I wasn't sure if it was possible to reverse engineer the private key and regenerate the hash value so it would match and bypass the validation.
Mark's blog: developMENTALmadness.blogspot.com
Mark J. Miller wrote:
The link to confirm would include the email address to be confirmed in plain text, and a hashed version of the same email address. So when the email is confirmed I can hash the plain text and compare the two values to make sure it hasn't been tampered with.
Why send it in plain text at all?? If the people are able to break the hash, then it's trivial for them to fake the address AND create a valid hash for it. Forget the plain text version of the address, it's just a clue to what MIGHT be in the hash. Part of security is divulging as little as possible about what the contents of the hash might be. Instead, don't compute a one-way hash of the address. Use an symetric encryption scheme where you encrypt the address with public side of a key pair, convert it to a base 64 string to make it compatible with being in a URL, then stick that in the email. When the link is clicked, the site should convert the base64 string back into the original binary bytes, then run that through the decryption using your _private_key. Besides, if the address doesn't show up in your "attempted, but not validated" database table, you can just ignore the address sent to you or log it in a table that tracks invalid validation attempts.
A guide to posting questions on CodeProject[^]
Dave Kreskowiak Microsoft MVP Visual Developer - Visual Basic
2006, 2007, 2008 -
Mark J. Miller wrote:
The link to confirm would include the email address to be confirmed in plain text, and a hashed version of the same email address. So when the email is confirmed I can hash the plain text and compare the two values to make sure it hasn't been tampered with.
Why send it in plain text at all?? If the people are able to break the hash, then it's trivial for them to fake the address AND create a valid hash for it. Forget the plain text version of the address, it's just a clue to what MIGHT be in the hash. Part of security is divulging as little as possible about what the contents of the hash might be. Instead, don't compute a one-way hash of the address. Use an symetric encryption scheme where you encrypt the address with public side of a key pair, convert it to a base 64 string to make it compatible with being in a URL, then stick that in the email. When the link is clicked, the site should convert the base64 string back into the original binary bytes, then run that through the decryption using your _private_key. Besides, if the address doesn't show up in your "attempted, but not validated" database table, you can just ignore the address sent to you or log it in a table that tracks invalid validation attempts.
A guide to posting questions on CodeProject[^]
Dave Kreskowiak Microsoft MVP Visual Developer - Visual Basic
2006, 2007, 2008Thanks, I'm trying to get rid of old, bad habits and instead think and code more securely. Your response is very helpful.
Mark's blog: developMENTALmadness.blogspot.com
-
Thanks, I'm trying to get rid of old, bad habits and instead think and code more securely. Your response is very helpful.
Mark's blog: developMENTALmadness.blogspot.com
Use a known secret key on your server, hash the address mixed with the key (xor, say) Then send the result. People won't be able to generate a hash for an address without your key. Of course this means you'll need to keep the hashcode in your database - in which case you may as well just give them a random confirmation guid. Guess-the-GUID is guaranteed to be about as fun as 52 card pickup, but longer playing times ;)
Mark Churchill Director Dunn & Churchill Free Download:
Diamond Binding: The simple, powerful, reliable, and effective data layer toolkit for Visual Studio.