Skein-256(160) Hash

What is Skein-256(160)?

Skein-256(160) is a truncated variant of the Skein cryptographic hash function, designed as part of the NIST Hash Competition (SHA-3) but ultimately excluded from the finalists. Derived from the broader Skein family, it inherits its triple-layered structure—pre-whitening, bit mixing, and post-whitening—operating on 128-bit blocks with a 512-bit internal state, though its output is truncated to 160 bits (20 bytes) for efficiency. Skein was engineered to balance performance across diverse hardware (CPUs, GPUs, and even FPGAs) while maintaining collision resistance, but its truncated variants like 256(160) were intended for applications requiring compact digests, such as lightweight authentication or checksums in constrained environments. The algorithm employs a variable-round structure (102 rounds for 256-bit security) and a keyed mode, though the 160-bit truncation reduces its effective security margin, making it unsuitable for high-assurance cryptographic purposes.

The primary vulnerabilities of Skein-256(160) stem from its truncated output size and architectural design choices. The 160-bit digest provides only ~80 bits of effective security (per the birthday paradox), rendering it susceptible to brute-force attacks via optimized GPU/ASIC implementations, which can achieve hash rates exceeding 10^12 hashes per second. Additionally, Skein’s lack of a built-in salt or key-derivation mechanism in its non-keyed mode exposes it to rainbow table attacks when used for password hashing. Collision resistance is further compromised by the truncated output, as the 160-bit space is insufficient to prevent practical collision-finding attacks under modern computational resources. Finally, Skein’s parallelizable structure enables adversaries to exploit GPU/FPGA acceleration, exacerbating its vulnerability to brute-force and meet-in-the-middle attacks, particularly in scenarios where precomputation (e.g., for password cracking) is feasible.

Identifying Skein-256(160) Hashes

Identifying a hash blindly is often difficult because multiple algorithms can output strings of the exact same length. For example, a standard 32-character hexadecimal string could be MD5, NTLM, MD4, or LM. To definitively identify Skein-256(160), security researchers analyze the hash against a strict regular expression (regex) signature (shown above) to find structural matches.

How to Crack Skein-256(160)

If you need to recover the plaintext password for a Skein-256(160) hash during a penetration test or forensics investigation, you must supply the correct module ID to your cracking software. Use the exact commands provided at the top of this page to target the hash successfully.