Friday, 6 September 2013

Does knowledge about value length compromise hash integrity

Does knowledge about value length compromise hash integrity

If I am storing a hashed value in a database, but the length of the
original value being hashed is fixed (eg. always 4 characters), does this
compromise the one-way nature of the hashing function?
More precisely, I have sensitive strings which I then encrypt and store in
a database. In order to search for these strings, I don't want to decrypt
every entry in the database, so I also store the hash of the first 4
characters of the string in another column. When I want to search the
database I generate the hash of the first 4 characters of the search term
and compare it to the stored hashes to find which entries match or could
match and then decrypt those entries to check for collisions and get the
rest of the data related to that entry.
My worry is that since an attacker would know that the length of the
strings being hashed is constant (4 characters), he/she would only need to
generate a table of all possible 4 letter strings and their hashes and
look-up the hashed values stored in my database (thereby giving away the
first 4 characters of the original sensitive string).

No comments:

Post a Comment