0

I am trying to interpret some data and ensure and based on the length of the data (48 chars) I am assuming (based on this post) it is being stored as a SHA384 hash.

The odd thing is though that all data instances begin with the same 5 characters in all cases. Which makes me question whether it is a SHA hash or something home grown, as I do not believe that even describes a legitimate salted' hash with 6+42 unique bytes.

Whether I enter "chickenfood" "esa8f7s#4312" or "Hello World", the first 5 bytes no matter what I enter is always the same in the output.

I did also try putting some of my test cases above into one of those so called reverse hash sites but they all errored.

It is a .NET application storing the data,does this sound like SHA or does it point to something else?

Community
  • 1
  • 1
CRSouser
  • 658
  • 9
  • 25
  • 1
    Do you have access to the code? It is possible that the developer is adding a 6 byte "magic number" to provide context to the hash data. – mageos May 08 '15 at 22:46
  • @megeos I do not have access to the code. Trying to recover/export data from an otherwise unaccessible data source. – CRSouser May 08 '15 at 22:47
  • Can you share what those first 6 bytes are? I notice on http://en.wikipedia.org/wiki/SHA-2 that hash values are often preceded by "0x ", which would translate to six Unicode (UTF16) bytes. – StriplingWarrior May 08 '15 at 23:02
  • @StriplingWarrior Err.. no, they aren't: that's just indicating in the text that the following value is in hex. – Andrew Morton May 08 '15 at 23:16
  • @AndrewMorton: Right, but my point is that if that's a common way of representing them, I could see some developer sending a byte-conversion of the hex string representation of the hash, including some preceding characters to indicate that it's a hex string, rather than just sending the actual bytes of the hash. – StriplingWarrior May 11 '15 at 15:30
  • 1
    @StriplingWarrior I was *so* hoping that couldn't happen. We wait on CRSouser's response... – Andrew Morton May 11 '15 at 18:25
  • @AndrewMorton I believe it is AQABA – CRSouser May 11 '15 at 19:31
  • @CRSouser Could it have a connection with the [city of Aqaba](http://en.wikipedia.org/wiki/Aqaba)? Either way, it may just be a marker for some program to recognise that the data "belongs" to it. – Andrew Morton May 11 '15 at 20:02
  • @AndrewMorton I did think about that and found the city as well. But nope.. data is consistent between sub-apps too – CRSouser May 11 '15 at 20:03

0 Answers0