Hashing: fingerprints for data

Why hashes are everywhere in security

Imagine you download a 2 GB installer. How do you know nobody changed it on the way? Comparing 2 GB byte by byte is slow, and you would need the original. Instead, the publisher shows a short fingerprint of the file, and you compute the same fingerprint on your copy. If they match, the file is the same. That fingerprint is a hash.

What a hash function does

A cryptographic hash function takes input of any size and gives output of a fixed size, called the hash or digest. A good one has these properties:

• Deterministic: the same input always gives the same hash.
• Avalanche effect: changing one letter changes the hash completely.
• One-way: you cannot work backwards from the hash to the input.
• Collision-resistant: it is practically impossible to find two different inputs with the same hash.

import hashlib

print(hashlib.sha256(b"hello").hexdigest())
print(hashlib.sha256(b"Hello").hexdigest())
print(hashlib.sha256("namaste".encode()).hexdigest())

Hashing is NOT encryption. Encryption is two-way: with the key you get the data back. A hash is one-way: there is no key and no way back.

Common algorithms

Use 1: checking a file has not changed

$ sha256sum ubuntu-24.04-desktop-amd64.iso
<64 hex characters>  ubuntu-24.04-desktop-amd64.iso

PS> Get-FileHash .\setup.exe -Algorithm SHA256

Algorithm Hash                                                             Path
--------- ----                                                             ----
SHA256    <64 hex characters>                                              C:\Downloads\setup.exe

File integrity monitoring (FIM) tools hash important system files and alert when a hash changes unexpectedly.

Use 2: identifying malware

Threat reports list the SHA-256 hashes of known malicious files. Security tools compare the hashes of files on your computers against these lists. This catches known files fast, but an attacker who changes one byte gets a new hash, so hashes are only one layer of detection.

Use 3: storing passwords

Websites should never store your actual password. They store a hash, and when you log in they hash what you typed and compare. But a plain fast hash is not enough: attackers who steal the database can try billions of guesses per second, and two people with the same password would have the same hash.

• Salt: a random value, different for each user, added before hashing. Same passwords then give different hashes, and pre-computed tables of hashes (rainbow tables) become useless.
• Slow algorithms: bcrypt, scrypt, Argon2id or PBKDF2 with many iterations are designed to be slow, so each guess costs the attacker much more time.

import hashlib, os

salt = os.urandom(16)
key = hashlib.pbkdf2_hmac("sha256", b"chai monsoon pakoda", salt, 600_000)
print(salt.hex(), key.hex())

Common mistakes

• Using MD5 or plain SHA-256 to store passwords. Use Argon2id, bcrypt, scrypt or PBKDF2 with a salt.
• Calling hashing "encryption" in a report. It confuses everyone.
• Comparing a hash from the same untrusted website you downloaded the file from. Get the hash from the official source.
• Forgetting to encode text to bytes in Python: hashlib needs bytes, so use "text".encode().