Security Diaries All About Security
Related Articles
What is the purpose of Hashing or what is the problem that it’s trying to solve?
Let’s say you are trying to send a file from your device to your friend’s device and your friend would like to confirm whether the file you sent is the same file that is downloaded the same file or is it tampered with in transit.
Let us also look into how the files gets tampered in transit
- MiTM – Man in the middle attack, in this case there will be attacker in between you and your friend(considering simple case scenario), intercepts the data, manipulates the data and sends maliciously manipulated data to your friend.
- Compromised application, in this case let’s say you have uploaded a file to some server and your friend has to download it from the URL provided. If the server where your file is located is compromised then the attacker will replace the original file with a malicious file.
What is the problem in the above scenarios?
File integrity is being questioned in above scenarios. The user who is going to download the file doesn’t know whether he is downloading the intended file or malicious file. So this is purely integrity problem. Now hashing tries to solve this issue. Lets dive deep into what is hashing, how it works, different hashing algorithms and more.
What is hashing?
Hashing is a mathematical function that takes your data and generates a fixed length output string which is called Hash. Anytime you generate the hash of one data, the hash will always be the same. Even a small change like changing the character from small case to upper case will change the complete hash.
In the above example of file download between two friends, we can use hash in the following way.
- Sender generates the hash of the file to be sent and shares it with his/her friend, friend downloads the file and generates the hash using same hashing algorithm, compares it with the former hash shared by the sender, if its same then the file is intact, if not then the file has been tampered.
So the example I have given is used to validate the file integrity while downloading. Similarly there are so many use cases of hashing which we will be taking a look at below in the later part of this article.
How does hashing works?
Hashing is all about algorithms and mathematics.
- Message to hash(can be file too)
- Type of Hashing algorithms
- User passes message to hashing algorithm
- Hash generation, depends on the algorithm used the length of the hash varies
- Share the hash or store it
Properties or requirements of hash
There are certain functionalities or requirements that must be fulfilled for a hashing algorithm. It’s because the purpose of hash is data integrity and security of the hashing algorithms is very important. If we go deeper about how the properties or requirements work it’s all cryptography which is an ocean itself.
- One-Way(aka as First Preimage resistance): Any user can generate hash using user’s preferred hashing algorithm but using hash no one would be able to generate original data
- Deterministic: The same input always must return same output
- Collision resistance(aka as Second Preimage resistance): No two different inputs must return same hash
Hashing algorithms
- MD5
- SHA-1, SHA-224, SHA-256, SHA-384, SHA-512, SHA-512/224, and SHA-512/256
Use cases of Hashing
Credential storage: Storing passwords as plain text in a file or database is very dangerous so usually the credentials are stored after hashing, so in the case of breach the only way to identify the credentials is using Rainbow attack which we will discuss later.
Digital signatures: When data is signed and sent to the receiver, the hash is sent along with which the receiver can confirm the data isn’t modified.
Document management: When anyone downloads any file or document they can validate the integrity of the file using the hash shared by the owner.
