@kazani

Understanding Salting in Cryptographic Hashing The technique used in the @letshaveaword game is not encryption. It's a one-way cryptographic hash function (SHA-256) combined with a secret salt to create a secure commitment scheme. Encryption is reversible (you can decrypt with a key), but hashing is irreversible: you can't "unhash" something feasibly. The goal here is provable fairness: the organizer commits to a secret word upfront by publishing its hash, without revealing the word. Later, they reveal the salt + word, and everyone can verify the hash matches. This proves no cheating. ➡️ What is a Salt? A salt is a random string added to the input before hashing. It: - Makes identical inputs produce different hashes. - Defeats precomputed attacks (like rainbow tables). - Attackers to brute-force the unknown salt (impossible if the salt is long and truly random). ➡️ The Method: Salt + Hash Commitment The exact scheme in the game: - Choose a secret 5-letter word (e.g., "apple"). - Generate a secret random salt (64 hex characters = 32 random bytes, very high entropy). - Concatenate: input = salt + word (no separator). - Compute: commitment = SHA-256(input) (as a hex string). - Publish the commitment hash publicly/onchain before any guesses. - Players guess; when someone wins (or round ends), reveal salt + word. - Anyone can recompute SHA-256(salt + word) and check it matches the published commitment. This is provably fair because: SHA-256 is preimage-resistant: given only the hash, finding any input that produces it is computationally infeasible (~2²⁵⁶ possibilities). The long secret salt makes brute-forcing all possible words useless you'd still need the exact salt. ➡️ Why this is secure? - Even if you try all ~100,000 common 5-letter words, each would need to be tested against 2¹²⁸ possible salts (for 32-byte randomness). Impossible. - No known practical attacks on SHA-256 preimage (as of 2026). - Common mistake to avoid: never reuse salts, and keep them truly random. Commitment schemes (like the game): salt is secret until reveal, for hiding the value temporarily. @starl3xx.eth am I right? Play here 👇🏻 and wins the $ETH jackpot 🤔

3 replies

8 recasts

26 reactions