A secure hash algorithm maps input of any size to a fixed-size output. SHA-256 produces the same 256-bit result every time for identical input, whether the input is a short string or a large file. section 4.2.1
Use SHA as a standardized cryptographic primitive rather than implementing one yourself:
- Rely on the one-way property: a hash should not feasibly reveal its original input. section 4.2.1
- Rely on collision resistance: finding two different inputs with the same hash should not be feasible. section 4.2.1
- Choose a standardized, peer-reviewed implementation from a programming language’s standard library and follow information-security approval requirements. section 4.2.1
Table 4.2 Hash values using SHA-256 for inputs of varying sizes
|
Input
|
SHA-256 hash value represented as hexadecimal number
|
|---|---|
|
1-byte lowercase “a”
|
ca978112ca1bbdcafac231b39a23dc4da786eff8147c4e72b9807785afee48bb
|
|
1-byte uppercase “A”
|
559aead08264d5795d3909718cdd05abd49572e84fe55590eef31a88a08fdffd
|
|
2.6GB ubuntu.iso file
|
b45165ed3cd437b9ffad02a2aad22a4ddc69162470e2622982889ce5826f6e3d
|
Compare SHA-256 outputs for inputs ranging from one character to a 2.6 GB file. section 4.2.1
