Level 3 · 3B Encryption · Lesson 2 of 3
Hashes: digital fingerprints
A hash is a digital fingerprint of a file or a text: a fixed-length string that comes out of a calculation. It has three key properties: the same content always gives the same fingerprint, a tiny change changes the whole fingerprint, and you can't go from the fingerprint back to the content.
What they're used for
To check that a file wasn't modified: the official site publishes its program's SHA-256 and you calculate the one of the file you downloaded. If they match, it's the original. Also to store passwords: the site keeps the fingerprint, and when you log in it compares the fingerprint of what you typed with the stored one.
sha256sum instalador.zip
cat huellas-oficiales.txt- sha256sum calculates the SHA-256 fingerprint of the file you downloaded.
- Then you compare it with the one the official site publishes. If a single character doesn't match, the file was changed.
Passwords: slow and salted hashes
For passwords, not just any hash will do. MD5 and SHA-1 are broken, and even SHA-256 is too fast: an attacker with the stolen database tries billions of passwords per second. Deliberately slow algorithms are used, like Argon2id, bcrypt or scrypt, with a “salt”: a random value different for each user, so two identical passwords don't give the same fingerprint.
Going deeper
Collisions
A collision is when two different contents give the same fingerprint. With a good hash, finding one is practically impossible. With MD5 and SHA-1, collisions have already been made on purpose: that's why they aren't used for signing or for checking downloads of anything important.
Review questions
You change a single letter of a file. What happens to its SHA-256?
Answer: The whole fingerprint changes. A tiny change produces a completely different fingerprint: that's how any modification is detected.
What's the best way to store passwords?
Answer: With a slow, salted hash like Argon2id. A slow, salted hash can't be reversed and makes guessing passwords blindly very expensive.
Your download's SHA-256 fingerprint doesn't match the official site's. What do you do?
Answer: You don't install it: the file was tampered with or is damaged. If the fingerprint doesn't match, it isn't the original file. Delete it and download it from the official source.