sha384($salt.$pass) Hash

What is sha384($salt.$pass)?

SHA-384 is a member of the SHA-2 family of cryptographic hash functions, standardized as part of FIPS 180-4 under NIST’s Secure Hash Algorithm project. Introduced in 2005 as an extension of SHA-256, it processes input data through a 512-bit block cipher with a 384-bit output, designed to resist collision attacks and provide stronger security than its shorter counterpart. The format `sha384($salt.$pass)` concatenates a cryptographic salt (typically a random byte string) with the plaintext password before hashing, a technique known as *key stretching* to mitigate rainbow table attacks. This structure is primarily employed in password storage (e.g., via PHP’s `password_hash()` function) to balance computational overhead with security, though its raw hashing speed (~1.5 GB/s on modern CPUs) remains insufficient for modern cryptanalysis defenses.

Despite SHA-384’s 384-bit output, its vulnerability stems from three critical flaws: **computational inefficiency**, **GPU/ASIC acceleration**, and **salt implementation quirks**. Modern attackers leverage parallelized hardware (e.g., FPGA/ASIC clusters) to brute-force hashed passwords at rates exceeding 10^12 hashes/second, rendering the 384-bit space impractical for password storage. Additionally, poor salt handling—such as non-uniform distribution or insufficient entropy—can expose patterns, enabling *salted rainbow tables*. While SHA-384 itself is collision-resistant (per its design), its output is too small for secure key derivation (e.g., against quantum attacks), and its linear hashing speed makes it susceptible to *time-memory tradeoff* attacks (e.g., optimized with CUDA or OpenCL). The format’s reliance on legacy assumptions (e.g., CPU-bound hashing) renders it obsolete for high-security contexts, despite its theoretical strength.

Identifying sha384($salt.$pass) Hashes

Identifying a hash blindly is often difficult because multiple algorithms can output strings of the exact same length. For example, a standard 32-character hexadecimal string could be MD5, NTLM, MD4, or LM. To definitively identify sha384($salt.$pass), security researchers analyze the hash against a strict regular expression (regex) signature (shown above) to find structural matches.

How to Crack sha384($salt.$pass)

If you need to recover the plaintext password for a sha384($salt.$pass) hash during a penetration test or forensics investigation, you must supply the correct module ID to your cracking software. Use the exact commands provided at the top of this page to target the hash successfully.