📖 What is Hashing?
Hashing is a one-way cryptographic process that transforms data of any size into a fixed-size alphanumeric string, known as a hash value or digest. This function ensures data integrity by detecting any alterations to the original data, as even a minor change results in a significantly different hash.
"Hashing is fundamental to many security functions, including password storage, digital signatures, and data integrity verification. Understand that hashing is *not* encryption; it's a one-way function. Be familiar with common hashing algorithms (SHA-256, MD5 – though MD5 is considered insecure) and the concept of salting passwords."
📚 Certification: Certified Information Systems Security Professional (CISSP)
🔑 What are the Key Concepts of Hashing?
- ▸ Hashing algorithms produce a fixed-size output regardless of input size, making them efficient for data comparison and integrity checks.
- ▸ Hashing is a one-way function; it’s computationally infeasible to reverse the process and obtain the original data from the hash value.
- ▸ Salting adds a random value to a password before hashing, mitigating rainbow table attacks and increasing password security.
- ▸ Collision resistance is a crucial property – a good hashing algorithm minimizes the chance of different inputs producing the same hash value.
- ▸ Hashing is used for data integrity verification; any change to the original data will result in a different hash, indicating tampering.
🎯 How does Hashing appear on the CISSP Exam?
You may be asked to identify the primary purpose of hashing in a password storage system, differentiating it from encryption and explaining the role of salting.
A scenario might describe a file download where a checksum is provided. Expect questions about how hashing verifies the file's integrity during transmission.
Expect questions about the vulnerabilities of older hashing algorithms like MD5 and SHA-1, and why they are no longer considered secure for critical applications.
❓ Frequently Asked Questions
Why is salting so important when hashing passwords?
Salting prevents attackers from using pre-computed rainbow tables to crack passwords. Each password gets a unique salt, making pre-computed tables ineffective and forcing brute-force attacks.
What is a collision, and why is it a concern with hashing?
A collision occurs when two different inputs produce the same hash value. While inevitable, a strong hashing algorithm minimizes collisions, as they can be exploited in certain attacks.
Can hashing be used to *encrypt* data?
No, hashing is a one-way function and cannot be used for encryption. Encryption is a two-way process, allowing data to be both encrypted and decrypted, while hashing only creates a digest.