hashing

Hashing

What is hashing?

• In A Level Computer Science, hashing is a method to convert any data into a fixed-size string of characters

• This fixed-size output is often called a digest

• Same input will always produce the same hash, providing consistency

• Even a minor change in input produces a radically different hash, giving it sensitivity to data changes

Some common hashing algorithms are:

• MD5 (Message Digest 5)

  • Widely used but considered weak due to vulnerabilities to collision attacks

• SHA-1 (Secure Hash Algorithm 1)

  • Previously used in SSL certificates and software repositories, now considered weak due to vulnerabilities

• SHA-256 (Part of the SHA-2 family)

  • Commonly used in cryptographic applications and data integrity checks. Considered secure for most practical purposes

• SHA-3

  • The most recent member of the Secure Hash Algorithm family, designed to provide higher levels of security

Comparison of encryption and hashing

Hashing and encryption both turn readable data into an unreadable format, but the two technologies have different purposes.

Hashing for password storage

• Hashing is commonly used for storing passwords

• When the user first signs up, the password they provide is hashed

• The hashed password is stored in the database, rather than as plaintext

• When users try to log in, they enter their username and password

• The system hashes the password entered by the user during the login attempt

• The hashed password is compared against the stored hash in the database

• If the hashes match, the user is authenticated and granted access

• If they don’t match, access is denied

• Hashing passwords adds an extra layer of security

• Even if the database is compromised, the attacker can’t use the hashed passwords directly

• In case of a data breach, not storing passwords in plaintext minimises the risk and potential legal repercussions

• Users’ raw passwords are not exposed, reducing the impact of a data breach

• Since the hash function always produces the same output for the same input, verifying a user’s password is quick

Why is hashing an efficient method for data retrieval?

Database lookup

• A good hash function uniformly distributes keys across the hash table, allowing for a more balanced and efficient data retrieval

• In the example below, the hashed Users table for a website is shown

  • The hashed table has no order

  • New users are randomly inserted into the hash table, which leads to a uniform distribution

  • If the website application needs to fetch the user’s data from the table, it is computationally more efficient to query using the hash digest value than any other attribute

  • This is because hash digests have a fixed length, making it easier for the computer to compare hash digests rather than variable-length strings like email addresses

• The hash digest serves as a summarised representation of the data (email address in the above example)

Data integrity

• Another benefit of hashing data is being able to verify its integrity

• When data is being transferred over a network, it is susceptible to loss of packets or malicious interference, so if two hashes are compared and are identical, it allows a system to verify the integrity of data

• This is because the same data hashed by the same hashing function will produce the same digest

• Comparing two fixed-size hashes is computationally less intensive than string comparison