Home > Glossary > CompTIA Security+ Certification Exam > Hashing

📖 What is Hashing?

Hashing is a one-way cryptographic process converting variable-length data into a fixed-size hash value. This function is deterministic; the same input always produces the same output. Hashing ensures data integrity by detecting modifications, but does not provide confidentiality as the original data cannot be recovered.

🥋 Sensei Says:

"Crucially, understand hashing’s role in password storage (salting and hashing) and file integrity checks. The exam will test your ability to distinguish hashing from encryption. Be prepared to identify common hashing algorithms like SHA-256 and MD5, and their relative security strengths."

📚 Certification: CompTIA Security+ Certification Exam (SY0-701)

🔑 What are the Key Concepts of Hashing?

▸ Hashing algorithms like SHA-256 and SHA-3 are preferred over older algorithms like MD5 and SHA-1 due to increased collision resistance and security.
▸ Salting adds a random value to a password before hashing, preventing attackers from using precomputed rainbow tables to crack passwords.
▸ Hashing is used for file integrity verification; changes to a file will result in a different hash value, indicating tampering or corruption.
▸ Hashing is a one-way function – it’s computationally infeasible to reverse the process and obtain the original data from the hash value.
▸ Collisions (different inputs producing the same hash) are possible, but good hashing algorithms minimize the probability of this occurring.

🎯 How does Hashing appear on the SY0-701 Exam?

You may be asked to identify the purpose of a checksum or hash value when verifying the integrity of a downloaded software file.

A scenario might describe a compromised system where passwords were stolen; expect questions about how salting and hashing could have mitigated the damage.

Expect questions about comparing the security strengths of different hashing algorithms and choosing the most appropriate one for a given application.

❓ Frequently Asked Questions

Why is salting so important when hashing passwords?

Salting prevents attackers from using pre-calculated tables of hash values (rainbow tables) to quickly crack passwords. Each password gets a unique salt, making rainbow tables ineffective.

What's the difference between a collision and a weakness in a hashing algorithm?

A collision is when two different inputs produce the same hash. While collisions are theoretically possible, a *weak* algorithm has a high collision probability, making it vulnerable to attacks.

Can hashing be used to protect sensitive data in transit?

No, hashing is not suitable for protecting data in transit. It's a one-way function and doesn't provide confidentiality. Encryption is required to secure data during transmission.

Related Terms from CompTIA Security+ Certification Exam

Brute Force Attack Intrusion Detection System ARP Poisoning Malware Asymmetric Encryption Risk Mitigation

📝 Related Study Guides

Study Guide 9 min read

How to Pass CompTIA Security+ (SY0-701) on Your First Try

To pass CompTIA Security+ SY0-701 on your first try, build a structured 6-8 week study plan covering all five domains, prioritize understanding concepts over memorization, practice with scenario-based questions daily, and consistently score 85% or higher on practice exams before scheduling your test. Hands-on lab experience is essential for performance-based questions.

Deep Dive 8 min read

Zero Trust Architecture: Security+ (SY0-701) Deep Dive

Zero Trust architecture is a security framework based on the principle "never trust, always verify." Unlike traditional perimeter security, it assumes breaches are inevitable and requires strict identity verification for every person and device attempting to access resources, regardless of whether they are inside or outside the network perimeter.

Exam Tips 8 min read

Security+ PBQs: Master Firewall ACLs & Incident Response

Security+ Performance-Based Questions (PBQs) are scenario-driven simulations requiring you to apply knowledge to real-world tasks. To master them, focus on firewall ACL rule ordering, the "implicit deny" principle, and analyzing system logs for incident response. Consistent practice with high-fidelity simulations is the most effective way to ensure exam success.