What is hashing?

What is hashing?

Hashing is the process of feeding data into a hash function, an algorithm that produces a short, fixed-size output called a hash, digest or message digest. The input can be one word or a multi-gigabyte disk image. SHA-256, for example, always returns 256 bits, normally written as 64 hexadecimal characters.

A hash works as a fingerprint: two files with the same SHA-256 digest can be treated as identical. Hashing has no key and no reverse operation, so a hash cannot be decrypted back into its input, which is the main difference from encryption.

Properties of a cryptographic hash function

• Deterministic: the same input gives the same digest on every system and tool, which is what lets two parties compare values.
• Fixed length: a given algorithm always returns the same output size, whatever the input.
• One-way: working backward from a digest to an input that produces it is not practical (preimage resistance).
• Avalanche effect: changing one character of the input flips about half of the output bits, so similar inputs give unrelated digests.
• Collision resistant: nobody can practically find two inputs that share a digest. Collisions must exist, since inputs outnumber outputs, but a sound algorithm keeps them out of reach.

Which hash algorithms are safe to use

MD5 and SHA-1 still catch accidental corruption, since random errors do not create engineered collisions, but they are unacceptable wherever an adversary could forge data: signatures, certificates, code signing and passwords. SHA-256 is the everyday choice; SHA-384 and SHA-512 suit policies that call for a bigger margin.

Example: checking a download

A vendor posts a SHA-256 value beside an installer. After downloading, hash your copy and check that every character matches. In PowerShell, Get-FileHash .\agent-setup.msi uses SHA-256 by default. On Linux, sha256sum agent-setup.tar.gz prints the digest, and sha256sum -c SHA256SUMS reports OK or FAILED for each listed file. On Windows, certutil -hashfile agent-setup.msi SHA256 also works; always name the algorithm, because certutil otherwise calculates SHA-1. Do not run a file that fails the check.

A match proves your copy is identical to whatever the published value was computed from. It does not prove who published it: an attacker who controls the download site can swap the file and the posted hash together. Proving origin takes a digital signature, which signs the hash with the publisher's private key, or an HMAC, which mixes a shared secret key into the calculation.

Where else hashing is used

• Password storage: systems store a password hash, not the password, but a fast hash such as plain SHA-256 is not enough; passwords need a unique salt and a deliberately slow algorithm such as bcrypt, PBKDF2 or Argon2id, a technique called key stretching.
• Data protection: a hash lets a system match a value without keeping it readable, though values with few possibilities, such as phone numbers, can be recovered by hashing every candidate.
• Threat detection: malware samples are tracked by SHA-256, and EDR tools block known-bad hashes. Altering a single byte gives a sample a new digest, so hash indicators match only identical files.
• File integrity monitoring: stored hashes of system files are rechecked on a schedule, and any change raises an alert.
• Forensics: investigators hash a drive and its image at acquisition and again before analysis to show the evidence is unchanged.

Hashing vs. encryption vs. encoding

Hashing is one-way, keyless and fixed-length; use it to prove nothing changed or to verify a value you never store. Encryption is reversible with a key; use it when authorized people must read the data again. Encoding, such as Base64, is reversible by anyone, needs no key and provides no security.

Hashing on the CompTIA Security+ exam

Hashing belongs to SY0-801 objective 1.3 on choosing the right cryptographic solution. It returns in objective 3.3 as a data protection method beside masking, tokenization and encryption, and supports evidence integrity in objective 4.8. Scenario wording that points to hashing: confirm a file was not altered, show evidence has not changed since collection, or store a value that must be checked but never recovered. If the question also needs proof of who produced the data, move to a digital signature, or HMAC when two systems share a key. Data that must be read back later needs encryption. MD5 and SHA-1 are wrong whenever an attacker could exploit a collision, and plain SHA-256 is the tempting wrong answer for password storage. Salting is taught with hashing; key stretching still appears in study material, but SY0-801 no longer lists it as a separate item.