InfoSec Notes
HubCybersecurity vs Information SecurityHistory of Information SecurityImportance of Information SecuritySecurity Principles and the CIA TriadWhat is Information Security?Accountability in Information SecurityAuthentication in Information SecurityAuthorization in Information SecurityAvailability in Information SecurityConfidentiality in Information SecurityIntegrity in Information SecurityNon-Repudiation in Information SecurityAES - Advanced Encryption StandardAsymmetric Key CryptographyDES - Data Encryption StandardDigital SignaturesEncryption vs DecryptionCryptographic Hash FunctionsIntroduction to CryptographyPublic Key Infrastructure (PKI)RSA AlgorithmSymmetric Key CryptographyIntroduction to Access ControlAttribute-Based Access Control (ABAC)Discretionary Access Control (DAC)Mandatory Access Control (MAC)Role-Based Access Control (RBAC) — Information SecurityZero Trust Security ArchitectureFirewalls in Network SecurityIntrusion Detection Systems (IDS)Intrusion Prevention Systems (IPS)Network Monitoring and AnalysisNetwork Security BasicsSecure Network DesignVirtual Private Networks (VPN)Wireless Network SecurityAPI SecurityIntroduction to Application SecuritySecurity Code ReviewDependency and Supply Chain SecurityDynamic Application Security Testing (DAST)Secure Software Development LifecycleStatic Application Security Testing (SAST)Web Authentication MechanismsCross-Site Scripting (XSS)Cross-Site Request Forgery (CSRF)File Upload SecurityHTTPS and SSL/TLSSecure Coding Practices — Information SecuritySession Management SecuritySQL Injection Attacks and PreventionIntroduction to Web SecurityOS Access Control ModelsEndpoint SecurityFile System Permissions and SecurityLinux SecurityIntroduction to OS SecurityUser Account ManagementWindows SecurityCloud Security FundamentalsCloud Security Best PracticesContainer Security — Information SecurityData Security in the CloudCloud Identity and Access ManagementKubernetes SecurityShared Responsibility Model — Information SecurityIntroduction to Digital ForensicsDisk ForensicsDigital Evidence CollectionDigital Forensic ToolsIncident Investigation ProceduresMemory ForensicsNetwork ForensicsContainment StrategiesDetection and Analysis PhaseEradication and RecoveryIntroduction to Incident ResponseIncident Response LifecycleIncident Response PlaybooksPost-Incident Review and Lessons LearnedBusiness Continuity PlanningDisaster Recovery PlanningRisk Assessment MethodologyIntroduction to Risk ManagementSecurity ControlsThreat ModelingVulnerability AssessmentCompliance ManagementGDPR Data Protection OverviewISO 27001 Information Security ManagementNIST Cybersecurity FrameworkSecurity Audits and AssessmentsSecurity GovernanceSecurity Policies and StandardsCloud Security Interview QuestionsCryptography Interview QuestionsInformation Security CheatsheetInformation Security Interview QuestionsNetwork Security Interview QuestionsGlossary of Information Security TermsImportant Security Concepts ReferenceRecommended Books and Learning ResourcesSecurity Tools OverviewIncident Response LabLog Analysis ProjectNetwork Monitoring ProjectPassword Manager ProjectSecure Login System ProjectVulnerability Scanner ProjectInsider ThreatsMalware Types and AnalysisPhishing Attacks and PreventionRansomware AttacksSecurity Threats OverviewSocial Engineering AttacksSpyware and Surveillance SoftwareTrojan Horse MalwareComputer VirusesNetwork Worms
Comprehensive guide to hash functions including MD5, SHA family, properties, applications in password storage, integrity verification, and digital signatures with Python implementations.
What is a Hash Function?
A cryptographic hash function is a mathematical algorithm that maps data of arbitrary size to a fixed-size output (the hash or digest). It is a one-way function — you cannot recover the original input from the hash.
| Input (any size) | [Hash Function] → Fixed-size Output (digest) |
| "Hello" | SHA-256 → "185f8db32271fe25f561a6fc938b2e26..." (256 bits) |
| "Hello!" | SHA-256 → "334d016f755cd6dc58c53a86e183882f..." (256 bits) |
| [1GB file] | SHA-256 → "a1b2c3d4e5f6..." (still 256 bits) |
Required Properties
| Property | Description | Importance |
|---|---|---|
| Deterministic | Same input always gives same output | Verification works |
| Fixed output size | Any input → same size hash | Practical storage/comparison |
| Pre-image resistance | Cannot find input from hash | Passwords, commitments |
| Second pre-image resistance | Cannot find different input giving same hash | Document integrity |
| Collision resistance | Cannot find ANY two inputs with same hash | Digital signatures |
| Avalanche effect | Small input change → drastically different hash | Tamper detection |
Hash Algorithm Comparison
| Algorithm | Output Size | Status | Speed | Use Case |
|---|---|---|---|---|
| MD5 | 128 bits | BROKEN | Very Fast | Legacy checksums only |
| SHA-1 | 160 bits | BROKEN (2017) | Fast | Git (legacy), avoid |
| SHA-256 | 256 bits | SECURE | Medium | General purpose, Bitcoin |
| SHA-384 | 384 bits | SECURE | Medium | High-security applications |
| SHA-512 | 512 bits | SECURE | Fast (64-bit) | Large data, certificates |
| SHA-3-256 | 256 bits | SECURE | Medium | Alternative to SHA-2 |
| BLAKE2b | Variable | SECURE | Very Fast | High-performance apps |
| BLAKE3 | Variable | SECURE | Fastest | Parallel hashing |
Python Implementation
Example
import hashlib
import hmac
import os
import time
class HashDemonstration:
"""Demonstrate various hash function properties and uses."""
def compare_algorithms(self, data: str):
"""Compare different hash algorithms on the same input."""
algorithms = ['md5', 'sha1', 'sha256', 'sha384', 'sha512']
data_bytes = data.encode()
print(f"Input: \"{data}\" ({len(data_bytes)} bytes)")
print(f"\n{'Algorithm':<12}{'Hash (hex)':<70}{'Bits'}")
print("-" * 100)
for algo in algorithms:
h = hashlib.new(algo, data_bytes).hexdigest()
bits = len(h) * 4
print(f"{algo:<12}{h:<70}{bits}")
def demonstrate_avalanche(self, text1: str, text2: str):
"""Show how a tiny change produces completely different hash."""
hash1 = hashlib.sha256(text1.encode()).hexdigest()
hash2 = hashlib.sha256(text2.encode()).hexdigest()
# Count differing characters
diff_chars = sum(1 for a, b in zip(hash1, hash2) if a != b)
total_chars = len(hash1)
# Count differing bits
diff_bits = bin(int(hash1, 16) ^ int(hash2, 16)).count('1')
total_bits = total_chars * 4
print(f"Input 1: \"{text1}\"")
print(f"Hash 1: {hash1}")
print(f"Input 2: \"{text2}\"")
print(f"Hash 2: {hash2}")
print(f"\nDifference: {diff_chars}/{total_chars} hex chars ({diff_chars/total_chars*100:.1f}%)")
print(f" {diff_bits}/{total_bits} bits ({diff_bits/total_bits*100:.1f}%)")
def file_integrity_check(self, filepath: str) -> str:
"""Calculate SHA-256 hash for file integrity verification."""
sha256 = hashlib.sha256()
with open(filepath, 'rb') as f:
for chunk in iter(lambda: f.read(8192), b""):
sha256.update(chunk)
return sha256.hexdigest()
def password_hashing(self, password=[REDACTED_PASSWORD] -> dict:
"""Secure password hashing with salt and iterations."""
salt = os.urandom(32)
iterations = 600000
# PBKDF2 - Key Derivation Function
hash_value = hashlib.pbkdf2_hmac(
'sha256', password.encode(), salt, iterations
)
return {
"algorithm": "PBKDF2-SHA256",
"iterations": iterations,
"salt": salt.hex(),
"hash": hash_value.hex()
}
def verify_password(self, password=[REDACTED_PASSWORD] stored: dict) -> bool:
"""Verify password against stored hash."""
salt = bytes.fromhex(stored["salt"])
computed = hashlib.pbkdf2_hmac(
'sha256', password.encode(), salt, stored["iterations"]
)
return hmac.compare_digest(computed.hex(), stored["hash"])
# Demonstrations
demo = HashDemonstration()
# 1. Compare algorithms
print("=== Algorithm Comparison ===")
demo.compare_algorithms("Information Security")
# 2. Avalanche effect
print("\n=== Avalanche Effect ===")
demo.demonstrate_avalanche("Hello World", "Hello World!") # Just one char difference
# 3. Password hashing
print("\n=== Secure Password Hashing ===")
stored = demo.password_hashing("MySecureP@ssw0rd!")
print(f" Algorithm: {stored['algorithm']}")
print(f" Iterations: {stored['iterations']}")
print(f" Salt: {stored['salt'][:32]}...")
print(f" Hash: {stored['hash'][:32]}...")
# Verify correct password
print(f" Verify correct: {demo.verify_password('MySecureP@ssw0rd!', stored)}")
print(f" Verify wrong: {demo.verify_password('wrong_password', stored)}")
Applications of Hash Functions
1. Password Storage
Example
NEVER store passwords in plaintext!
Bad: users table: | username | password |
| alice | secret123 | ← Exposed in breach!
Good: users table: | username | salt | hash |
| alice | a7b3c9... | pbkdf2(secret123, salt, 600K) |
Even if database is stolen, passwords cannot be recovered.
2. Data Integrity Verification
python example
# Verify downloaded file integrity
expected_hash = "e3b0c44298fc1c149afbf4c8996fb924..." # From publisher
computed_hash = hashlib.sha256(open("software.exe", "rb").read()).hexdigest()
if computed_hash == expected_hash:
print("File integrity verified - safe to install")
else:
print("WARNING: File has been tampered with!")3. Digital Signatures
Signing Process
Document → [SHA-256] → Hash → [Encrypt with Private Key] → Signature
Verification Process
Document → [SHA-256] → Computed Hash
Signature → [Decrypt with Public Key] → Original Hash
Compare: Computed Hash == Original Hash?
MD5 and SHA-1: Why They're Broken
MD5 Collision (2004)
python example
# MD5 collision example (two different inputs, same MD5 hash)
# These were generated by Wang et al. (2004)
# In practice, attackers can create colliding PDFs, certificates, etc.
import hashlib
# Demonstration of why MD5 is broken
message1 = "Transfer $100 to Account A"
message2 = "Transfer $999 to Account B"
hash1 = hashlib.md5(message1.encode()).hexdigest()
hash2 = hashlib.md5(message2.encode()).hexdigest()
print(f"Different inputs, different hashes (as expected):")
print(f" MD5(\"{message1}\") = {hash1}")
print(f" MD5(\"{message2}\") = {hash2}")
print(f"\nBut researchers can CONSTRUCT two different files with SAME MD5!")
print(f"This means MD5 cannot guarantee document integrity.")
print(f"\nTimeline of MD5/SHA-1 breaks:")
print(f" 2004: MD5 collision found (Wang et al.)")
print(f" 2008: MD5 used to forge SSL certificates (Sotirov et al.)")
print(f" 2017: SHA-1 collision found (Google 'SHAttered' - $110K compute)")
print(f" 2020: SHA-1 chosen-prefix collision ($45K compute)")HMAC (Hash-based Message Authentication Code)
python example
import hmac
import hashlib
def hmac_demonstration():
"""HMAC combines hash with secret key for authentication."""
secret_key = b"shared_secret_between_alice_and_bob"
message = b"Transfer $5000 from savings to checking"
# Create HMAC
mac = hmac.new(secret_key, message, hashlib.sha256).hexdigest()
print(f"Message: {message.decode()}")
print(f"HMAC-SHA256: {mac}")
# Verify (receiver computes HMAC with same key)
received_message = b"Transfer $5000 from savings to checking"
computed_mac = hmac.new(secret_key, received_message, hashlib.sha256).hexdigest()
# Use constant-time comparison to prevent timing attacks
is_valid = hmac.compare_digest(mac, computed_mac)
print(f"Verification: {'VALID' if is_valid else 'INVALID'}")
# Tampered message fails verification
tampered = b"Transfer $50000 from savings to checking"
tampered_mac = hmac.new(secret_key, tampered, hashlib.sha256).hexdigest()
print(f"\nTampered verification: {hmac.compare_digest(mac, tampered_mac)}")
hmac_demonstration()Interview Questions
- Why can't you decrypt a hash to get the original data?
- Hash functions are mathematically one-way (pre-image resistant). Information is lost during hashing — infinite inputs map to finite outputs. You cannot determine which specific input produced a hash. Additionally, hash functions use non-invertible operations (modular arithmetic, bit shifting).
- What is a rainbow table attack and how do you prevent it?
- A rainbow table is a precomputed database mapping common passwords to their hashes. Prevention: use a unique random salt for each password. With salt, even identical passwords produce different hashes, making precomputed tables useless.
- Explain the birthday paradox and its relevance to hash collisions.
- The birthday paradox shows that in a group of just 23 people, there's a 50% chance two share a birthday. For hash functions, finding a collision requires approximately 2^(n/2) attempts (not 2^n). For MD5 (128-bit), collisions need ~2^64 operations — feasible with modern computing.
- Why is bcrypt/Argon2 preferred over SHA-256 for password hashing?
- SHA-256 is fast (designed for speed), which helps attackers try billions of guesses per second. bcrypt/Argon2 are intentionally slow (configurable work factor), memory-hard (resists GPU/ASIC attacks), and include built-in salt handling. They're designed specifically for password storage.
- What is the difference between a hash and an HMAC?
- A hash only takes data as input (anyone can compute it). An HMAC takes data + secret key, providing both integrity and authenticity. Only someone with the key can create a valid HMAC, preventing forgery. HMACs also resist length-extension attacks that affect plain hashes.
Summary
Hash functions are fundamental building blocks of information security, used for password storage, integrity verification, digital signatures, and authentication. Always use SHA-256 or better for security applications, use purpose-built KDFs (Argon2, bcrypt) for passwords, and never use MD5 or SHA-1 for any security purpose.
Exam Focus
Revise definitions, diagrams, examples, and short-answer points for Cryptographic Hash Functions.
Interview Use
Prepare one clear explanation, one practical example, and one common mistake for this Information Security topic.
Search Terms
information-security, information security, information, security, cryptography, hash, functions, cryptographic hash functions
Related Information Security Topics
Continue learning this concept
CryptographyAES - Advanced Encryption StandardComplete guide to the AES algorithm covering its structure, rounds, key expansion, modes of operation, implementation in Python, and why AES replaced DES as the global encryption standard.CryptographyAsymmetric Key CryptographyDeep dive into public key cryptography covering RSA, ECC, Diffie-Hellman key exchange, digital signatures, and how asymmetric algorithms solve the key distribution problem.CryptographyDES - Data Encryption StandardUnderstanding the Data Encryption Standard (DES), its Feistel structure, historical significance, vulnerabilities, evolution to 3DES, and why it was replaced by AES.CryptographyDigital SignaturesComplete guide to digital signatures covering RSA and ECDSA signing, verification process, certificate chains, applications in code signing and documents, with Python implementations.CryptographyEncryption vs DecryptionUnderstanding the fundamental processes of encryption and decryption, their differences, step-by-step operations, and practical applications in modern information security.CryptographyIntroduction to CryptographyFoundational guide to cryptography covering core concepts, terminology, classical ciphers, modern algorithms, and the role of cryptography in securing information systems.