An Illustrated Guide to Cryptographic Hashes - The Diigo Meta page

• 10 Feb 18
  

  stuza1 .

  Crypto Infosec

• 07 Apr 14
  

  Romana Challans

  hashing cryptography security hash encryption md5 sha1 aes

• 01 Sep 13
  

  Ellie K

  older, approx 2005 but good ref

  hash cryptography md5

• 06 Aug 13
  

  jmurali

  bitcoin

• 22 Feb 13
  

  Malcolm Herring

  From Internet Explorer Developer Info Encryption

• 11 Feb 13
  

  kevinxucs
  • A "hash" (also called a "digest", and informally a "checksum") is a kind of "signature" for a stream of data that represents the contents.
  • try changing just one character of a small test file. You'll find that even very small changes to the input yields sweeping changes in the value of the hash
  • Encryption transforms data from a cleartext to ciphertext and back
  • "Encryption" is a two-way operation
  • compile a stream of data into a small digest (a summarized form: think "Reader's Digest"), and it's strictly a one way operation
  • Verifying file integrity
  • Hashing passwords
  • It's a bad idea for computer systems to store passwords in cleartext
  • there is no way to find out for sure "what password produced this hash?"
  • salt. This is a random bit of text added to the cleartext passwords before running through the hash function
  • Digitally Signed Documents
  • one signs (encrypts with one's private key) the hash of the document, the result of which is a digital signature
  • different chunks of data produce the same hash value, this is known as a collision
  • nobody has found a collision yet
  • Exploiting weak collision resistance: If we are able to create two inputs that generate the same hash, digital signature become suspect
  • Exploiting weak preimage resistance: If we are able to "work backwards" from a hash and create some text that produces the same hash, we can use this to beat hashed passwords
  • Exploiting second weak preimage resistance: As with preimage resistance, we want to fool somebody into authenticating our data as genuine
  • So what's the big news?
  • Five hundred twelve bits of hash holds 1.34 x 10¹⁵⁴ possible values, which is far, far more than the number of hydrogen atoms in the universe [ref]. This is likely to be safe from brute-force attacks for quite a while.
  • we are not crypto experts

  18 more annotations...

• 16 Jul 12
  

  Kiran Kuppa

  A "hash" (also called a "digest", and informally a "checksum") is a kind of "signature" for a stream of data that represents the contents. The closest real-life analog we can think is "a tamper-evident seal on a software package": if you open the box (change the file), it's detected.
  Let's first see some examples of hashes at work.

  cryptography security hashing

• 27 Jun 12
  

  pedrokoblitz

  criptologia

• 14 Apr 12
  

  Jon Huber
• 06 Apr 12
  

  Zehra Nasif

  • Fig. 1: Encryption - a two-way operation 

      

     Hashes, on the other hand, compile a stream of data into a small digest (a summarized form: think "Reader's Digest"), and it's strictly a one way operation. All hashes of the same type - this example shows the "MD5" variety - have the same size no matter how big the inputs are:

  • Fig. 2: Hashing - a one-way operation 

      

     "Encryption" is an obvious target for attack (e.g., "try to read the encrypted text without the key"), but even the one-way nature of hashes admits of more subtle attacks. We'll cover them shortly, but first we must see for what purposes hashes are commonly used.
  • We'll note here that though hashes and digests are often informally called "checksums", they really aren't. True checksums, such as a Cyclic Redundancy Check are designed to catch data-transmission errors and not deliberate attempts at tampering with data. Aside of the small output space (usually 32 bits), they are not designed with the same properties in mind. We won't mention true checksums again.
  • How are hashes used?
  • Verifying file integrity
  • if the website publishes the hash values of its download bundles, you can check it yourself. For instance, the ProFTPD project (an excellent open source FTP server) publishes their hashes: 

      

     

      
  • Now it's just a matter of running the md5sum command on the file you downloaded and comparing it with the published values.
  • Important!

    ---

     When considering hash values, close does not count! 

     If the hashes being compared differ in any way, even by just a single bit, the data being digested is not the same! There is no equivalent of "roundoff error" or "almost" in cryptographic hashes.
  • Hashing passwords
  • "hashing is not encryption".
  • A more secure way is to store a hash of the password, rather than the password itself. Since these hashes are not reversible, there is no way to find out for sure "what password produced this hash?" - and the so consequence of a compromise is much lower. 

      

     

     
  • Note - in practice there is usually an additional wrinkle to hashed passwords: the introduction of what's known as a salt. This is a random bit of text added to the cleartext passwords before running through the hash function, and in the examples above, the salt is between the $ signs. This step improves the security of the stored hash, but we're not going to elaborate on this step in this document.

  10 more annotations...

• 06 Mar 12
  

  Avinash R

  cryptography interview

• 24 Feb 12
  

  Rajeev Jha

  hash cryptography

• 11 Oct 11
  

  arunyogesh

  cryptography security hash crypto md5 collision reference

• 28 Dec 10
  

  sandesh

  hash cryptography guide

• 10 Sep 10
  

  Alex Ko

  cryptography hash

• 09 Sep 10
  

  timwee

  hash hashfunction cryptography

• 04 May 09
  

  Rodrigo de Oliveira

  With the recent news of weaknesses in some common security algorithms (MD4, MD5, SHA-0), many are wondering exactly what these things are: They form the underpinning of much of our electronic infrastructure, and in this Guide we'll try to give an overview

  artigo criptografia explicação geek hash segurança from_delicious

• 20 Mar 09
  

  Daniele Tricoli

  security algorithms math crypto hashing md5 sha encryption hash cryptography

• 11 Jan 09
  

  Peter Eddy

  programming security mathematics crypto

• 18 Aug 08
  

  crypto cryptography hash encryption security

• 02 Aug 08
  

  n d

  Guide describes hash algorithms and weaknesses therein.

  security encryption

• 10 Jul 08
  

  thenatsky

  hash

• 28 May 08
  

  jason m

  crypto article

• 11 Mar 08
  

  Nick Cotter

  security hash

• 07 Mar 08
  

  Krzysztof Klimczyk

  security hash cryptography hacking

• 28 Feb 08
  

  isaac Mao

  Computing Crypto Security

• 07 Nov 07
  

  K Cheng

  encryption security

• 24 Sep 07
  

  Orla Moeller
• 18 Sep 07
  

  Girish M

  security

• 10 Sep 07
  

  Vamsee Krishna M

  algorithm article bookmarks code computer crypto cool development

• 27 Aug 07
  

  Sean Flynn

  crypto

• 16 Apr 07
  

  minaev

  comp crypto

• 11 Apr 07
  

  I Md Yanuarta DPY

  cryptography encryption hash imported delicious security

• 23 Jan 07
  

  Luciano Evaristo Guerche

  algorithms article code computer crypto cryptography encryption guide hash howto math md5 programming reference science security software tech toread tutorial unix

• 25 Oct 06
  

  Rented User

  cryptography hash reference security

• 24 Oct 06
  

  Vladislav Zlobin

  cryptography tutorial

• 16 Sep 06
  

  Karoly Czifra

  criptographia encoding hash md5

• 23 Aug 06
  

  Jan Tichý

  bezpečnost hash kryptografie

• 07 Aug 06
  

  Richard

  crypto docs howto infosec passwords tools

• 27 Jul 06
  

  N A

  Delicious illustrated guide cryptographic hash cryptography encryption security hacking cipher reference articles resource

• 24 Jun 06
  

  Eoin Lane

  crypto reference security

• 07 Jun 06
  

  Robert Talbert

  computers crypto cryptography encryption mathematics tutorial geek delicious-import

• 07 Apr 06
  

  daehrednud

  cryptography

• 23 Jan 06
  

  MrPhil Ludington

  gamedev

• 
• 

  Wei-Jing Zhu
• 

  David Eubanks

  hash md5sum

• 07 Sep 05
  

  linkmess

  How do computer administrators keep all those passwords secret? hashes.

• 27 Aug 05
  

  Erika Quirk

  Computers

• 03 Aug 05
  

  rramhap

  crypto tutorial

• 28 Jul 05
  

  Jim Dedzen

  nice

  site_building_Web_Page_Design_for_Designers_-_The_Business_of_Web_Design_SVC

• 29 Jun 05
  

  Juan Ciarlante

  jjo um.edu.ar crypto tutorial

• 24 Jun 05
  

  rohan_talip

  cryptography encryption security

• 30 Apr 05
  

  George Lazarides

  cryptography security hash Security

• 28 Apr 05
  

  rev up

  security privacy tech cryptography

• 

  Wade A

  hashing security

• 27 Apr 05
  

  tanuki_work

  A readable explanation of cryptographic digests known as hashes. It's a bit too introductory to be useful with regard to password hashing, which is interested in being computationally expensive rather than simply collision resistant (what hashing for integrity needs, as discussed here). Also this is an old reference so consult something newer.

  cryptography tutorials reference hashing

• 

  Donghai Ma

  security good-reads cryptography

• 

  Leandro Rodrigo Saad Cruz

  cryptography

• 15 Apr 05
  

  urban sheep

  crypto

• 26 Mar 05
  

  Stephen H

  crypt

• 17 Mar 05
  

  Jeff

  security reference privacy guide

• 16 Mar 05
  

  S Jones

  cipher hash code cryptography crypto algorithms _delicious

• 26 Feb 05
  

  Steve Wilson

  md5 hash encrypt Develop

• 21 Feb 05
  

  richtbreak

  hashing crypto

• 

  Thomas Wallace

  Linux Hacks

• 

  Eric Blue

  crypto

• 20 Feb 05
  

  robert179
• 

  The Anarcat

  security reference

• 18 Feb 05
  

  Rumbero 2010

  cryptography
  
  
  
  
  
  
  
  
  
  
  
  

  Simpy Bookmarks Imported

• 

  spigot

  Reference security

• 

  Ignacio Silva

  security reference

• 

  Philippe Normand

  security crypto

• 

  criptography criptología security 20101222

• 16 Feb 05
  

  jeanjordaan

  A "hash" (also called a "digest", and informally a "checksum") is a kind of "signature" for a stream of data that represents the contents. The closest real-life analog we can think is "a tamper-evident seal on a software package": if you open the box (cha

  crypto article hash

• 10 Feb 05
  

  Vladislav Zlobin

  cryptography tutorial

• 31 Jan 05
  

  Miska Lahti

  A "hash" (also called a "digest", and informally a "checksum") is a kind of "signature" for a stream of data that represents the contents.

  security

• 12 Jan 05
  

  jschoolcraft

  hash cryptography

• 03 Jan 05
  

  Dan O'Neill

  Cryptography

• 02 Jan 05
  

  Luyi Chen

  crypto

• 03 Nov 04
  

  Bjoern Stierand

  crypto programming security reference

• 07 Oct 04
  

  Paul Henman

  geek security

• 06 Oct 04
  

  derekgottlieb

  crypto

• 05 Oct 04
  

  Ed Garon

  crypto

• 04 Oct 04
  

  Johnny Bravo

  algorithms crypto hashing

• 02 Oct 04
  

  owen walton

  security

• 27 Sep 04
  

  Casper Kuijjer

  security

• 

  dani-el

  docs security toread

• 25 Sep 04
  

  Glenn Addison

  Development

• 29 Aug 04
  

  Tamás Martinec

  cryptography fromDelicious

• 28 Aug 04
  

  Xabi Vazquez

  crypto info

• 27 Aug 04
  

  theothergretchen

  *touch crypto programming security tutorial

• 25 Aug 04
  

  Liudvikas Bukys
• 

  Robert Feldt

  Interesting pedagogically, by mixing clear descriptions with visually enhancing diagrams and figures

  Crypto Explanation Pedagogy Teaching

Would you like to comment?

Join Diigo for a free account, or sign in if you are already a member.