Hashing algorithms are a foundational cryptographic tool used to verify data integrity, authenticate users, and ensure non-repudiation by converting input data into a fixed-length, one-way fingerprint. This content covers how hashes work, what makes a hash algorithm secure, and where hashing is applied in real-world systems.
Hashing Algorithms
Hashing algorithms are a really important part to keeping integrity, authenticity and non-repudiation, and they play a key role in our cryptography.
A hash is a lot like a fingerprint. My fingerprint identifies me, and so you can think of a hash as being a fingerprint that identifies something like a file or password or something. So it's a representation of that, and it's a unique representation of that. Now, unlike my fingerprint, which only identifies me and no one else has a fingerprint quite like mine, a hash could have some overlap. We are going to talk a little bit about that, but for the most part it's unique.
A hash is an algorithm, and this funnel right here represents this hashing algorithm. We could put information in there: user ID, transaction number, date of birth data. Maybe put all of these things into there. We put it into the funnel, and then we get this string out of it. This is our fingerprint right here.
There's some aspects to this hash value, this fingerprint, that we're looking for. One is it should be fixed length, so whatever this length is should be the same no matter what we put in the top.
A good hash value can only go in one direction. That is, whatever you put in the top gets put into, I'm representing it by a blender, it gets put into a blender to create this fingerprint. But there's no way to take the fingerprint, at least in a good hashing algorithm, and reverse engineer it to get the data back out.
Another important aspect of a good hashing algorithm is that it doesn't create patterns. What I mean by that is whatever data you put in gives you a very different fingerprint on the other side. So you could even change one little thing, like a day on the date of birth, you escalate it by one day, and this number just completely changes. So just one little change in the data, no matter how big it is, creates a drastic change down here.
We also want this fingerprint to be fairly unique, and I say fairly because there are times when there's overlap. What I mean by that is you could enter in somebody's user ID and it gets this fingerprint out. There are times when you might enter a different set of data and get the same fingerprint. We don't want that to happen too often. When it does happen, when there's two sets of data that come out with the same fingerprint, we call that a hash collision.
There are a lot of use cases for hashing algorithms. One of them is for passwords. Let's give an example of what that looks like.
We have a user that's authenticating with our system. Now, if we store the passwords directly onto our database, this causes problems for a couple reasons. Number one, this database could be stolen, and if the database is stolen and all of the passwords are in clear text, now whoever has stolen this information has all the clear text passwords and can start using them right away. Another problem is we could have an internal threat that would go into this database and start stealing this as well and start looking at these. So we don't even want our internal admins to be able to see passwords. The only person that should be able to see a password is the user themselves.
So what we can do is we can take their password and put it through one of these algorithms. Let's say we put it through SHA, and we create a unique fingerprint, and that's what we store on the database. Now, the next time that this user sends their password, we're going to also put that through SHA, and then we will get a unique fingerprint and we'll compare that to what we have on the database. If the two fingerprints align and are the same, we know that the passwords are probably the same as well, and so then this person will have been authenticated and be allowed on the system.
Another example is we could verify some sort of file or program. That is, we want to download a file from a server, but the problem is that once we get it, we don't know if this was the actual file that we wanted. Perhaps somebody did a man-in-the-middle attack and has altered that and put some sort of virus on it. So we want to check it to make sure that it's accurate.
What we do is we put it through a hashing algorithm, let's use SHA as the example again, and we create a unique fingerprint, and so we have this fingerprint of this document right here. What we can do is we can compare what is a known good fingerprint of that document with the one that we have created here, and if it's the same we know that this document is okay.
There are a lot of hashing algorithms out there, and we would choose it based off of what purpose we're using it for, whether we wanted a CRC or checksum type. Here's some I've got highlighted. There are some of the more popular that you'll hear mentioned throughout this course.
I will mention that MD5 is probably not one that you'll want to use. We'll mention it because it's had a lot of prevalence in the past and is still part of some of the protocols that we are going to mention, but it's not one that we're going to necessarily want to use. SHA is going to be the ones that we'll probably be using the most out there right now.
TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.
Explore free tools and programs →