Game Giveaway: The Price is Right Edition

A hash function is a "one way function". You put a string in, get a different string out, but there does not exist an inverse function. That's because hash functions can take in an unlimited amount of data, but always output only a few bytes. So for a given output (ex: 6879e144663fc05aacacbd7daf8614aa) you'll have multiple possible inputs that can produce it.

If a website wants to verify someone knows their password they'll store an initial hash of the password during account registration. Then when the user returns and types in their password to sign in the site will hash the password and compare the hashes. You can verify the input is the same as during registration if the hashes match. The benefit here is the website isn't storing the password. So if the database gets leaked hackers won't know what the passwords are.

In order to allow for verification that the amount in this giveaway was pre-determined I hashed the dollar amount. But even though hashes are one-way functions you can reverse them when you know there's only a small number of possible inputs. So if I hashed something in the format of $53.25, and an adversary knew that's what I did, they could get hashes for every dollar amount up to thousands of dollars and compare against the hash I listed. The solution is to add a salt to the input - The correct price is: . As long as the adversary doesn't know the salt (to be fair it's not a very secure salt because it's semantically related to the post) then you can safely have the rest of the input be very predictable. What's cool is the salt can be as long as you want. I could have stuck an entire book at the beginning of the input. All that matters is when I come back with the full original input + salt it hashes to the value I originally posted.

Edit: Thanks for the Exemplary, kind stranger!