OpenEuphoria

Re: Crack better hash()

• Posted by Derek Parnell <ddparnell at bigpond.com> Jun 21, 2003
• 405 views

Lucius,
I took the liberty of using your basic algorithm and tweaking it a bit to
increase its security. The caller to this version can specify how many
output characters to give, plus they can add some 'unknowns' by supplying
two seed values.

Also, to cater for nested input sequences, I've included a small routine to
flatten out the input first.

 ---------------------
function flatten(sequence s)
 ---------------------
    sequence r

    r = {}
    for i = 1 to length(s) do
        if sequence(s[i]) then
            r &= flatten(s[i])
        else
            r &= s[i]
        end if
    end for

    return r
end function
 ---------------------
global function qhash(sequence s,integer l, atom seed1, atom seed2)
 ---------------------
    sequence result
    integer m

    s = flatten(s)
    if l < 1 then
        l = length(s)
    end if
    result = repeat(seed1*seed2, l)
    m = or_bits((1+length(s)) * (l+1),1)
    for A = 1 to length(s) do
        result += 1
        for B = 1 to length(result) do
            m = and_bits(or_bits(m+seed2,1),#FFFF)
            result[B] = xor_bits(result[B],(s[A] + B + m))
        end for
        result = and_bits(result, #FF)
    end for

    return result
end function

 ---------------------
 ---------------------
Here is an example of how it might be used...

 ---------------------
sequence s, prodkey
s = qhash({"Version=2.4",
           "Client=OpenEU Group",
           "MaxUsers=20",
           "Products=EuInterp,EuTrans"}
            , 16, 3.1473, 6981)
prodkey = {}
for i = 1 to length(s) do
    prodkey &= sprintf("%02x", s[i])
    if i != length(s) and remainder(i,4) = 0 then
        prodkey &= '-'
    end if
end for
printf(1,"Licence key is : %s\n", {prodkey})

---------
By varying the seed values, you can get different results for the same
input. This means that it is much harder to crack if you don't know which
seeds were used to generate it.

You can get a similar effect by varying the output length too.

--
Derek