What Is a Hash?
A hash computes a value from data for comparison. This guide focuses on cryptographic hashes used in security. Hashing does not encrypt or hide the original data.
Hash fundamentals
SHA-256 produces 256 bits (32 bytes), normally displayed as 64 hexadecimal characters. The same input bytes and algorithm give the same result. Identical-looking text can have different bytes because of its encoding or line endings.
Distinguish the security properties
- Preimage resistance: finding an input for a given digest is difficult. Inputs with few plausible candidates, such as weak passwords, can still be guessed and checked.
- Second-preimage resistance: given an input, finding another input with the same digest is difficult.
- Collision resistance: finding any two distinct inputs with the same digest is difficult. It does not mean collisions do not exist.
- The avalanche effect describes how small input changes affect many output bits. That property alone does not establish cryptographic security.
Calculate a SHA-256 digest
This Python 3 standard-library example hashes the three bytes abc, without a trailing newline. A hash is not a format that can be decrypted to recover the input.
import hashlib
print(hashlib.sha256(b"abc").hexdigest())
# ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015adCommon algorithms
Choose an algorithm for the application and its specification, rather than ranking algorithms by name or output length alone.
MD5
Do not choose MD5 for new designs that require collision resistance, such as digital signatures or protection against deliberate substitution. Accidental corruption and malicious forgery are different threats.
SHA-1
Practical collisions have been demonstrated. Do not choose SHA-1 for new applications requiring collision resistance. Follow the relevant migration policy when legacy compatibility is required.
SHA-2
This family includes SHA-256 and SHA-512. SHA-256 is widely used for file comparison, but an unkeyed digest alone does not prove who distributed a file.
SHA-3
SHA-3 uses a different construction from SHA-2. SHA3-256 has a fixed output size. FIPS 202 also specifies SHAKE functions with selectable output lengths, so not every hashing function has a single fixed output length.
Store passwords safely
Use a password-hashing library rather than plain SHA-256 or a home-made repeated-hashing scheme.
Configure salts and cost parameters
- Generate a random salt for each stored password and save it with the hash. A salt is not a secret key.
- Use a password-specific scheme such as Argon2id and tune its time and memory costs for your environment. Where compliance requirements apply, choose a scheme accepted by those requirements.
- Store the scheme, salt and cost parameters. Use the library's verification function and rehash after successful authentication when the settings need upgrading.
- Higher costs slow offline guessing after a leak; they do not make weak passwords unguessable. Online login attempts also need controls.
Hashes, HMAC and encryption
Select the mechanism that matches the goal.
Compare the purposes
If an attacker can replace both the file and its reference digest, a matching digest is not enough. Anyone holding an HMAC key can generate valid tags. Replay prevention needs additional protocol rules, such as authenticating and checking timestamps or one-time values.
| Goal | Mechanism |
|---|---|
| Detect corruption | Compare a file digest with the expected value. |
| Verify the distributor | Obtain the reference through a trusted channel, or verify a digital signature with a trusted key. |
| Authenticate with a shared key | Use a message authentication mechanism such as HMAC. |
| Keep content secret | Use suitable authenticated encryption. Hashes and HMAC do not conceal content. |