Home › Security Architecture & Engineering
Hashing Explained — Cryptography (Part 4)
Security Architecture & EngineeringCISSPSecurity+
Hashing is one-way cryptography: a typically 160- to 512-bit Message Digest you compare to detect tampering, and the right tool for passwords you must never decrypt. In Part 4 of our Cryptography series, we cover collision resistance and the birthday attack, MD5 / SHA-1 / SHA-2 / SHA-3 / HAVAL / RIPEMD, HMAC versus digital signatures, and salted password hashes.
What you will learn
- What a hash function is — one-way Message Digest, typically 160–512 bits
- How comparing hashes detects tampering
- Collisions, collision resistance, and the birthday paradox (23 ≈ 50%; 253 to match yours)
- Why MD5 (128-bit, 2005) and SHA-1 (160-bit; deprecated; browsers 2017) are broken; SHA-2 as the usual FIPS 180-4 family; SHA-3 as FIPS 202 / Keccak 2015
- HAVAL's variable lengths; RIPEMD-160 vs the insecure RIPEMD-256
- Why a bare hash can be overwritten — HMAC (RFC 2104) vs a digital signature (encrypt the hash with the private key)
- HMAC(K, M) = H((K′ ⊕ opad) || H((K′ ⊕ ipad) || M))
- Password hashing: LinkedIn 2012 breach, 2016 public (177 million hashes); PBKDF2 69 billion/s → 10,000/s; salt HASH(salt + password); pepper stored separately, overheads
- Why passwords are hashed, not encrypted