I am building an application in C# that works with a Progress database. The passwords that are stored in this database are stored using a hash algorithm that Progress has not made public. However, I would like to authenticate using these hashes. Is it feasible to reverse engineer such a hash algorithm and how would I go about doing this?
To be clear: I am not looking for a way to get the unhashed passwords from the hashes. I’m looking for the algorithm to get a hash from a password.
6
According to this topic you are not the first one who is looking for that algorithm. As already mentioned Progress is not willing to share much about this algorithm.
While it’s most probably possible to do crack the algorithm, it’s generally easier to use Progress itself to calculate hashes. The other option is to switch from using that Progress funtion to a more standard variants (like SHA-1).
Now, more clarification of what “variation” could possibly mean. Suppose something like:
string Encode(string pass) {
string salt = "123456";
return CRC16(pass + salt); // + for catenation
}
while it’s still same CRC16 it will produce totally different results (comparing to CRC16(pass)). So the only way to get real algorithm is to use disassembler to see the actual code, since it’s probably impossible to do anything observing only input and output.
There is no “structural approach” to guess algorithm from input and result unless you have a pattern, and that’s exactly that ideal hash need not to have.
6
You could use progress to insert a hashed password into a temp var and compare that to the stored hash.
Using progress to make that hash.
3
Well, you could take a list of all hashing algorithms you can think of, run them against a list of the most popular passwords and check whether any of the results match any of your hashes. Of course this will only work if the site did not enforce a strong password policy and the hashing algorithm isn’t exotic (or parameterized).
1