Hash Algorithms and Applications: Password Hashing and Beyond — Topics & Learning Outcomes

Module Topics

Introduction to Hashing Algorithms

• What Is a Hash Function? — A hash function is a mathematical algorithm that takes an input of arbitrary length and produces a fixed-length output, commonly called a hash, digest, or checksum.
• Fixed-Length Output and the Transformation Process — One of the defining characteristics of a hash function is that no matter how large or small the input, the resulting hash is always the same predetermined length.
• Core Properties of Cryptographic Hash Functions — Cryptographic hash functions must satisfy a set of strict properties that distinguish them from simple checksums or non-cryptographic hash functions.
• Hashing vs. Encryption: A Key Distinction — Hashing and encryption are both techniques used to protect data, but they serve fundamentally different purposes and should not be confused with one another.
• Common Hashing Algorithms and Their Use Cases — Several hashing algorithms are widely used in practice, each with different characteristics in terms of output length, speed, and security strength.
• The Role of Hashing in Data Integrity — Hashing plays a critical role in verifying that data has not been altered or corrupted during storage or transmission.

Cryptographic Hash Functions

• What Makes a Hash Function Cryptographic — Cryptographic hash functions are a specialized subset of hash functions designed to meet rigorous security requirements beyond simple data lookup or checksum tasks.
• Preimage Resistance — Preimage resistance ensures that given a hash output, it is computationally infeasible to determine any input that would produce that specific hash value.
• Collision Resistance — Collision resistance is the property that it is computationally infeasible to find two distinct inputs that produce the same hash output.
• The Avalanche Effect — The avalanche effect describes the property whereby a tiny change in input — even a single bit — produces a drastically different and unpredictable hash output.
• MD5: Capabilities and Known Weaknesses — MD5 (Message Digest Algorithm 5) was once widely used for checksums and password hashing but is now considered cryptographically broken for security-sensitive applications.
• SHA-256 and the SHA-2 Family — SHA-256 is part of the SHA-2 family of cryptographic hash functions developed by the NSA and standardized by NIST, producing a 256-bit digest that is widely trusted for security applications.
• Role of Cryptographic Hash Functions in Security Systems — Cryptographic hash functions serve as foundational primitives across a wide range of security contexts, including data integrity verification, digital signatures, and authentication systems.

Password Hashing Fundamentals

• Why Plain-Text Password Storage Is Dangerous — Storing passwords in plain text means any unauthorized access to the database immediately exposes every user's credentials.
• Limitations of Simple Cryptographic Hashes for Passwords — General-purpose hash functions like MD5 or SHA-256 were designed for speed, which makes them poorly suited for protecting passwords.
• The Role of Salting in Password Hashing — A salt is a unique, randomly generated value added to each password before hashing, ensuring that identical passwords produce different hash outputs.
• Dedicated Password Hashing Algorithms — Algorithms such as bcrypt, scrypt, and Argon2 were specifically designed for password hashing, incorporating features that resist modern attack methods.
• Work Factors and Computational Cost Tuning — Password hashing algorithms expose a work factor setting that controls how much computation is required to produce a single hash.
• How Systems Verify Passwords at Login — Because cryptographic hashes are one-way functions, systems verify passwords by re-hashing the candidate input and comparing the result to the stored hash.

Salting and Advanced Password Protection Techniques

• What Is Salting and Why It Matters — Salting is the practice of appending or prepending a unique, randomly generated value (the 'salt') to a password before hashing it, ensuring that identical passwords produce different hash outputs.
• Defending Against Rainbow Table Attacks — Rainbow tables are precomputed lookup tables mapping common passwords to their hash values, allowing attackers to reverse hashes rapidly without brute-force computation.
• Defending Against Dictionary and Brute-Force Attacks — Dictionary attacks rely on hashing lists of common passwords and comparing results to stored hashes; salting forces attackers to rehash every candidate password with each unique salt.
• Generating and Storing Salts — A salt must be generated using a cryptographically secure random number generator (CSPRNG) to ensure unpredictability, and it must be stored alongside the password hash for verification during login.
• Key Stretching — Key stretching is a technique that deliberately increases the computational cost of hashing a password by iterating the hash function many times, slowing down attackers attempting rapid brute-force guesses.
• Modern Password Hashing Algorithms: bcrypt and scrypt — bcrypt and scrypt are purpose-built password hashing algorithms that incorporate salting and key stretching by design, and are considered significantly more secure than applying a general-purpose cryptographic hash directly to a password.
• Argon2: The Modern Standard — Argon2 is the winner of the Password Hashing Competition (2015) and is now widely recommended as the state-of-the-art algorithm for password hashing, offering configurable time, memory, and parallelism cost parameters.

Ensuring Data Integrity with Hashing

• Hash Functions as Integrity Verification Tools — Hash functions produce a fixed-length digest that acts as a unique fingerprint for any given input, making them ideal for verifying that data has not been altered.
• Checksums for File and Data Verification — Checksums are hash values published alongside files or data packages, allowing recipients to independently verify that what they downloaded or received matches the original.
• Verifying Software Distribution Integrity — Software vendors and open-source projects use cryptographic hashes to ensure that distributed packages have not been modified by a malicious third party before installation.
• Hash-Based Message Authentication Codes (HMACs) — An HMAC combines a cryptographic hash function with a secret key to produce a message authentication code that verifies both the integrity and authenticity of a message.
• Digital Signatures and Hash Functions — Digital signatures use asymmetric cryptography together with hash functions to provide non-repudiable proof of data origin and integrity.
• Comparing Integrity Mechanisms: Checksums vs. HMACs vs. Digital Signatures — Different integrity mechanisms offer different levels of security and serve distinct use cases depending on whether authentication and non-repudiation are required.

Common Attacks and Vulnerabilities

• Brute-Force Attacks on Hashed Passwords — A brute-force attack attempts to recover a plaintext password by systematically hashing every possible input and comparing it to a stored hash value.
• Rainbow Table Attacks — Rainbow tables are precomputed lookup tables that map common plaintext values to their corresponding hash digests, allowing attackers to reverse a hash almost instantly.
• Collision Attacks — A collision attack occurs when an adversary finds two different inputs that produce the same hash output, undermining the integrity guarantees a hash function is expected to provide.
• Weak and Deprecated Hash Functions — Certain hash algorithms that were once considered acceptable have been proven cryptographically weak and are no longer safe for security applications.
• Unsalted Hashing and Its Consequences — Storing passwords as plain, unsalted hashes is one of the most common and dangerous implementation mistakes, enabling multiple classes of attacks simultaneously.
• Timing Attacks on Hash Comparison — Timing attacks exploit measurable differences in computation time during hash comparison to infer information about a secret value, even without direct access to the hash.
• Dictionary and Wordlist Attacks — Dictionary attacks narrow the brute-force search space by hashing known words, common passwords, and their variations rather than trying every possible character combination.

Best Practices and Real-World Applications

• Choosing the Right Hash Algorithm for the Job — Selecting an appropriate hashing algorithm is the foundation of secure implementation, as different use cases demand different algorithmic properties.
• Salting and Peppering in Authentication Systems — Salting and peppering are complementary techniques that significantly harden password hashing against precomputation and database-leak attacks.
• Hashing in Blockchain and Distributed Ledger Technology — Cryptographic hashing is the structural backbone of blockchain systems, enabling tamper-evident chaining of transaction records.
• Digital Forensics and Data Integrity Verification — In digital forensics, hash functions serve as cryptographic fingerprints that verify the authenticity and integrity of evidence throughout an investigation.
• Secure Communications: HMACs and TLS — Hash-based Message Authentication Codes (HMACs) and hashing within TLS protocols ensure both the integrity and authenticity of data in transit.
• Industry Standards, Compliance, and Ongoing Vigilance — Adhering to established standards and maintaining awareness of evolving threats is essential for sustaining the security of hash-based systems over time.

Student Learning Outcomes

By the end of this module, students will be able to:

Course Outcomes (reference)