M K said:
I am sincere in stating that I am not involved in password
cracking, spam, or hacking. I was simply interested in
testing a theory.
What I was considering would actually be more involved
than simply generating all those strings.
MD5 and SHA1 both use a 'one way' algorithm. You can't
just run the encrypted string through the algorithm again
to get the original string. However, an original string
would always generate the same encrypted string.
I wanted to see if this was true, because if you did go
through all those permutations, and developed a dictionary
you could theoretically look at the encrypted string,
compare it to the table, and find the original string.
Yes, if you had a big enough lookup table, this would be possible. It
could be made much harder, however, using salting. This is the process
of adding a few random characters to the start of the given password
before running it through the one-way transform. You put the same
characters at the start of the result as well, so that the process is
repeatable. For instance:
password=dont_tell_anyone (entered by user)
salt=xyz (randomly generated)
before transform=xyzdont_tell_anyone
after transform=123kjhd123dsf456
store in database as=xyz123kjhd123dsf456
When you check the password, you just ask the user to enter their
password, add the salt which appears in the database to the front of
it, and then transform the result.
To crack the result, you'd effectively need a table for all
combinations 62^(password length+salt length) instead of just
62^(password length) - and seeing as the salt could be as long as the
system wants it to be, that basically makes it entirely impractical to
dictionary attack it, even if the password itself isn't very long.