A hash function deterministically converts input of any length into a fixed-size digest. The digest acts like a one-way digital fingerprint: the same input produces the same result, while recovering the original input from its digest should be impractical. This makes digests useful for comparing data without retaining the raw value. section 6.1 section 6.5
Figure 6.1 Hash functions use one-way functions to calculate a fixed-length hash digest from a variable-length input message.
A variable-length message enters the function, but the resulting digest has a fixed length. This shape underlies both password comparison and file verification. section 6.1
Cryptographic hash functions are expected to resist three kinds of search:
- Preimage attacks: given Y = H(A), finding an input A that produces Y should be infeasible. section 6.5
- Second-preimage attacks: given Y = H(A), finding a different B with H(B) = Y should be infeasible. section 6.5
- Collision attacks: finding any distinct A and B with the same digest should be infeasible. Collisions always exist in principle because inputs are unbounded while digests are fixed-size; a function is broken when attackers beat the naive birthday-based search cost. section 6.5
For password storage, retain a digest rather than plaintext and hash the login attempt again for comparison. A changed character normally produces a radically different digest, causing the comparison to fail. This does not make ordinary fast hashing sufficient for passwords: dictionary and rainbow-table attacks precompute candidate digests for later reverse lookup. section 6.1 section 6.5
Download checksum
A publisher can provide an MD5 or SHA-256 checksum with a DVD image. After downloading the file, calculate its digest and compare it with the published value; even one corrupted byte should produce a mismatch. This detects accidental corruption, not a malicious party able to replace both the file and its unkeyed digest. section 7.1
Older MD5, SHA-1, and SHA-2 designs use Merkle–Damgård construction, which iteratively applies a compression function to blocks and exposes its internal state as the digest. SHA-3 uses a sponge construction with absorb and squeeze phases; this avoids length-extension weaknesses associated with the older design. section 6.3 section 6.5
Do not treat an unkeyed hash as message authentication. An attacker who can alter a message can hash their replacement too. In particular, secret-prefix MACs of the form H(key || message) are vulnerable to length-extension attacks when built from Merkle–Damgård hashes, enabling forged authenticated requests. section 7.1 section 7.3
For passwords, add a salt and use a dedicated slow password-hashing function such as PBKDF2 or Argon2 rather than directly applying a general-purpose hash. Salting forces new rainbow tables, while deliberate slowness raises the cost of precomputation and guessing. section 10.1.4
