Database examples

What is hashing? A guide with examples

If you work in the Technology Where cyber security industry, chances are you’ve heard of the term hash, but what is it and what is it for? At its core, hashing is the practice of transforming a string of characters into another value for security purposes. Although many people use the terms hashing and encryption interchangeably, hashing is still used for the purpose of one-way encryption, and hashed values ​​are very hard to decode. Encryption always offers a decryption key, while hashed information cannot be easily decoded and is intended to be used as a method of validating the integrity of an object or data.

What is hashing?

Hashing is the practice of transforming a string of characters into another value for security purposes. Although many people may use the terms hash and encryption interchangeably, hash is still used for one-way encryption purposes, and hashed values ​​are very difficult to decode.

More Katlyn Gallo5 Ways to Combat Alert Fatigue in Your Security Program

Who invented hashing?

The idea of ​​hashing was introduced in the early 1950s by an IBM researcher, Hans Peter Luhn. Although Luhn did not invent today’s algorithms, his work eventually led to the earliest forms of hashing. His colleagues gave him a challenge: they had to efficiently search a list of chemical compounds that had been stored in a coded format. Luhn knew there had to be a way to improve information retrieval for cases like this, and so the indexing process was born.

Over the next 30 years, scientists built on his invention of indexing to develop a way to codify plaintext., known as a hash. Hashing requires two components: a plaintext value and a hashing algorithm. Applying the algorithm to the plaintext value results in hashed output.

What is the hash used for?

As you might have already guessed, hashing is primarily used for security. A hash value has many uses, but it’s primarily intended to encode a value in the clear so that the information included cannot be exposed. Hash has many applications in cybersecurity. The most common are message integrity, password validation, file integrity and, more recently, blockchain. Each of these use cases relies on the main function of the hash: to prevent interference or tampering with information or a file.

What is the hash used for?

  • Message integrity.
  • Password validation.
  • File integrity.
  • Block chain.

Message hashing and integrity

Email integrity relies on a one-way hash function, commonly referred to as digital signature, which is applied by the sender. Digital signatures ensure message integrity through a public/private key pair and the use of a hash algorithm.

To digitally sign an email, the message is encrypted using a one-way hash function and then signed with the sender’s private key. Upon receipt, the message is decrypted using the sender’s public key and the same hashing algorithm is applied. The result is then compared to the original hash value to confirm that it matches. A matching value guarantees that the message has not been tampered with, while a mismatch indicates that the recipient can no longer trust the integrity of the message.

Hash and File Integrity

Hashing works the same way for file integrity. Often, technology providers offering publicly available downloads provide what is known as checksums. Checksums validate that a file or program has not been modified during transmission, typically a download from a server to your local client.

Checksums are commonly used in the IT field when professionals download operating system images or software to install on one or more systems. To confirm that he has downloaded a secure version of the file, the individual will compare the checksum of the downloaded version with the checksum indicated on the provider’s site. If the two values ​​match, the file is trustworthy. If they don’t match, the file may not be safe and should not be used.

As with digital signatures, a checksum is the output of applying a hashing algorithm to a piece of data, in this case a file or program. Checksums are common in the tech industry to verify files, but they also allow security vendors to track file reputation. The checksums, or hash values, of malicious files are stored unmodified in security databases, creating a library of known malicious files. Once a piece of malware is tagged in a reputation database and this information is shared among industry vendors, it is more difficult for the malicious file to be successfully downloaded or executed on a protected system. .

Password hashing and validation

Contrary to what many people might believe, when you enter your password to log into a device or account, the system does not directly validate your password. Instead, it hashes what you entered and then compares it with the stored hash value that the system or back-end database has.

Historically, and unfortunately in some cases today, passwords were stored in the clear. This meant that the system or main server of the site you were connecting to had the plaintext value of your password stored in a file or database. As computers became common household objects and the internet boom led to an increase in online activity, security researchers quickly realized that plaintext passwords would not suffice for privacy and protection. informations.

Today, most systems store the hashed values ​​of your password in their databases so that when you authenticate, the system has a way to validate your identity against an encrypted version of your password. pass.

For added security, some systems (those based on Linux, for example), add a salt, which is a 32 character string, at the end of the password before it is hashed. This step prevents two of the same hashes from occurring when two people have the same password, such as “Pa$$word123”. By adding a unique salt to each, it is impossible for the two hash values ​​to be identical. Salting passwords also makes them much harder to crack, which is valuable in the event of a data breach.

Hash and Blockchain

blockchain is a modern technology that enables efficient and immutable transactions. It has many uses now, including cryptocurrency, NFT markets, international payments, etc.. Blockchains operate in a peer-to-peer fashion where transactions are recorded and shared across all computers in the blockchain network. But how exactly can transactions be made immutable? By cryptographic hash, of course.

Hash in a blockchain works the same as the other use cases described above: a hash function is applied to a block of data to provide a hash value. The difference in its use within a blockchain is that blockchains use nuncios, which are random or semi-random numbers, and each transaction requires hashing the additional block of data. A nonce is a number that is used only once and is used to prevent replay attacks in a blockchain. Replay Attacks occur when an attacker intercepts a communication on a network and then retransmits that communication from his own system. As you might guess, this can have a significant impact on the security of a blockchain, so using nonces helps prevent them from succeeding.

As mentioned, each transaction generates a new block of data that needs to be hashed. Hash functions operate in various ways throughout the continuous loop that is the blockchain.

First, each block includes the hashed header value from the previous block. Before the new transaction is added, the header from the previous block is validated using this hash value. Like message and file integrity, the blockchain uses hash values ​​to perform similar validation to ensure that previous blocks of data have not been tampered with.

Once validated, the new block of data is added, along with a nonce, and the hashing algorithm is applied to generate a new hash value. This process creates a repeated cycle of hashing used to protect the integrity of transactions.

More in Cybersecurity8 Ways to Avoid 8 NFT Scams

The hash

Hashing has been, and continues to be, a valuable security mechanism for rendering data unreadable to the human eye, preventing interception by malicious individuals, and providing a means of validating its integrity. Over the years, hashing algorithms have become more secure and more advanced, making it difficult for malicious actors to reverse-engineer hashed values. Although hashes are always crackable, the complex mathematical operations behind them, along with the use of salts and nonces, make it less possible without massive computing power.