SHA-2 is a family of standardized cryptographic hash functions, including SHA-224, SHA-256, SHA-384, and SHA-512. Each function converts arbitrary input into a fixed-size digest. The same input produces the same digest, while changes to the input produce a different digest. SHA-2 provides integrity, not confidentiality or authentication. section 4.2.2 section 4.8
Validating a refunds file
A warehouse application stores refunds.json and a corresponding refunds.json.sha256 file. The payment service computes SHA-256 over refunds.json and compares the result with the expected digest. Matching values indicate that the contents were not accidentally changed; a mismatch raises an error and prevents refunds. This protects against network errors, disk failures, and accidental edits, but not an attacker who replaces both files. section 4.2.2
Use SHA-2 with these boundaries in mind:
- Choose a specific variant such as SHA-256; SHA-2 names the family rather than one algorithm. section 4.2.2
- Do not confuse a cryptographic digest with Java hashCode(); hashCode() is a 32-bit hash-table value, not a security mechanism. section 4.7
- Use HMAC when active tampering and sender authenticity matter; hashing a message with a secret concatenated to it is not a secure substitute. section 4.8 section 4.7
Java exposes SHA-2 through the JCA MessageDigest API. Calling MessageDigest.getInstance("SHA-256") requests an implementation by its standardized algorithm name, while the provider architecture separates application code from the underlying implementation. Applications should also plan for algorithm upgrades because cryptographic choices can become insecure over time. section 4.3 section 4.8
