Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Does a cracker need to know the number of iterations a hashing algorithm uses to compute a hash?

If they don't know it, how do they figure it out? How much longer does it take to figure it out, than if they didn't know?

I can only guess that they try a number of the most common passwords, and try it with different iterations, and see what amount of iterations returns the most correct passwords. Would this even work though?

share|improve this question
I'm not a security expert, but it seems to me that a good security system should be difficult to defeat even if the algorithm is open-source. – Robert Harvey Feb 7 '14 at 21:31
this has most likely been already asked and answered at Security.SE - they've got about 500 questions in the 'hash' tag – gnat Feb 7 '14 at 21:42
@gnat: Which one of those 500 answers this question? :) – Robert Harvey Feb 7 '14 at 21:56
@RobertHarvey if you're curious, migrate and see how regulars will close it as a dupe there, possibly along with voting down for apparent lack of effort. What is considered a reasonably high iteration count? – gnat Feb 7 '14 at 21:59

The usual attack models assume that the attacker knows the exact algorithm used and the only unknown is (in the case of hashing-to-hide-plaintexts) the plaintext. In short, the enemy already knows the system.

Sometimes this gives the attacker too much credit, but that's better then underestimating them. Since password hashes are typically retrieved by breaking into a production server, it's likely that the application source code (which includes a full specification of the hashing procedure used) was grabbed at the same time. In other cases, the source code is open to begin with.

share|improve this answer

Unless you implement hashing algorithm on server side, and use some non-standard algorithm, Everything about hashing algorithm is known to hacker. if implemented on client side, it can be reverse engineered, even if you use non-standard algorithm, or obfuscate a standard algorithm.

share|improve this answer
A non-standard algorithm implemented on the server does not hinder an attacker. That belief is security through obscurity and the reasons it's bad are too numerous to list in a single answer let alone comment. – delnan Feb 7 '14 at 21:39
One of the most fundamental concepts behind security is to use algorithms that are just as effective even if they are known to the attacker. – user16764 Feb 7 '14 at 22:24

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.