Is there a better way to find an unknown with loops in python?

Question

I am trying to "discover" what the UNKNOWN variable's value was when the hash_res was generated.

The only information that was given to me was that the following lines were used:

random.seed(UNKNOWN+hash(CONST_VAR))
hash_res = random.randint(1<<32, 1<<40)

Plus the value of CONST_VAR is a given which is 113092. The value of RESULT_VAR is also a given which is 75284812356.

So far this is what I've came up with but I am not sure if this is the right way or of there is a faster, better way.

import random
from hashlib import md5

UNKNOWN = 0
CONST_VAR = 113092
RESULT_VAR = 75284812356
hash_res = 0

while hash_res != RESULT_VAR:
    UNKNOWN = UNKNOWN+1
    random.seed(UNKNOWN+hash(CONST_VAR))
    hash_res = random.randint(1<<32, 1<<40)

print UNKNOWN

Basically I am looping the given hashing lines then for every iteration, I'd increment the value of the UNKNOWN until the value of hash_res matches the RESULT_VAR. Then print out the value of the UNKNOWN when the loop terminates (a.k.a. hash_res has matched RESULT_VAR)

It's a brute force approach and my question is, is there a better way?

NOTE: I am a c# developer, trying to learn something new :)

Answer 1

It's a brute force approach and my question is, is there a better way?

By all practical means for someone who is not a mathematical security/cryptography researcher, no.

The specification of a "hash" function is simply that it's a function that is nearly impossible to invert, i.e. brute forcing is the fastest way of reversing it.

There's a lot of tricks (rainbow tables, doing the math on a graphic card processor, or even a specialized chip etc) that make things faster, but aside from understanding the few weaknesses in MD5 and implementing this very close to the metal (read: probably C/C++, not python), there's nothing you can do.

Answer 2

It's a brute force approach and my question is, is there a better way?

You can try to improve your brute force, by reducing the number of operation that you do at each loop cycle.

For instance, you can store hash(CONST_VAR), 1<<32 and 1<<40 in variables.

You could also look at the source (as @tobias_k suggested), to find a quicker way to check if you have the right UNKNOWN (for instance using random.getstate() might be faster than random.randint(1<<32, 1<<40))

I advise you to do some tests with a known UNKOWN to find the fastest algorithm.

---

Edit

maybe you could try to use parallelism with multiple thread looking for the value at the same time (with 4 threads, the first looks for 4*n, the second for 4*n+1, and so on)