Hashing is a cryp­to­graph­ic method used to change datasets and char­ac­ters of any length into compact, fixed hash values. In doing so, hashing offers more security than en­cryp­tion since hash values cannot be converted back into their original values without the key. Hashing is used to manage and secure databases, user data, password man­age­ment and access au­then­ti­ca­tion.

What is hashing?

Hashing is an important cryp­to­graph­ic in­stru­ment used to convert data into hash values. In this case a special hash function is used, most often in the form of an algorithm. The main aim of hashing is as it sounds, it cuts things up. This is exactly what hashing does: Datasets such as passwords, company and user data and other forms of data is hashed and converted into a new shorter form, known as a hash value. In each hashing process, hash values are given the same length and represent original datasets. The hash values can then be stored in a more compact way as a hash table, meaning that less space is used.

The pros of hashing: Hash values cannot be converted back to their original values without a key. Even if criminals were able to access them, they couldn’t do anything with the hash values. People are often confused between hashing and en­cryp­tion. Since hash values are not encrypted, rather converted to a com­plete­ly new character string, they cannot be decrypted. To do so, you would need the cor­re­spond­ing key, the algorithm used and the original data which is as­so­ci­at­ed with the hash values.

How does hashing work?

Hashing is carried out in three steps:

  • Hash functions: A hash function is a cryp­to­graph­ic algorithm which cuts up data of different lengths com­plete­ly, separates it and converts it to character strings of the same length. These hash values are much shorter and more compact than the original values.
  • Hash values: Hash values are the result of the hash functions. Unlike the original values, as part of the hash method, they also have the same length of hexa­dec­i­mal strings. The set length of the hash values depends on the process.
  • Hash tables: Hash values can be stored in what’s known as a hash table. These require a lot less memory to store compared to the original datasets. To do this, datasets are given specific index values from hashing which shows where the data set is. This sig­nif­i­cant­ly shortens the time to process them, and the computing power required when looking for the in­for­ma­tion.

The way hashing works is based on five char­ac­ter­is­tics which guarantee security and re­li­a­bil­i­ty:

  • De­ter­min­is­tic: The hash function must always create a set, shorter hash value from entries with different lengths.
  • Un­read­able: Hashing converts original values into hash values which are in them­selves “un­read­able”. There is no way to decrypt the hash values in the classic sense and recreate the original text or character string.
  • Collision re­sis­tance: Different entries cannot be assigned the same hash value. If two original values get the same hash value, this is called a collision. Un­change­able and unique hash values reduce the chance of attack and increase security. However, depending on the situation, a collision may actually be desired.
  • Con­ti­nu­ity or non-con­ti­nu­ity: In general, hash values offer more security if they are not continual. In other words, different original datasets contain as many different hash values as possible. However, continual hash values might be better if you are using hashing to manage similar datasets and entries.
  • Speed: Hashing not only improves security, but it also allows for quicker access to databases.
Image: Illustration of a hashing process using passwords as an example
A hashing algorithm replaces original datasets with different lengths to set character strings known as hash values.

Hashing ap­pli­ca­tions

The uses and functions of hashing are par­tic­u­lar­ly clear when we look at different ap­pli­ca­tions and areas of use. Typical ap­pli­ca­tions include:

  • The creation of hash tables
  • The “en­cryp­tion” of important data
  • The search for du­pli­cates
  • Checksums and digital sig­na­tures
  • The search for similar data
  • Au­then­ti­ca­tion systems
  • Caching

Database man­age­ment

Hashing has a special benefit in that it allows data to be stored more compactly and ef­fi­cient­ly in the form of hash tables. Character strings are sum­ma­rized as hash values in the database as hash tables. This saves memory, improves security within the database and speeds up the search for certain entries in the hash tables. Hash values and hash tables improve the or­ga­ni­za­tion and man­age­ment of index and data in­fra­struc­ture.

Example: Customer databases often contain important in­for­ma­tion such as names, contact details or addresses of said customers. If a database needs to be searched for specific in­for­ma­tion, it will take a while with a normal search. This is because the whole database must be looked through to get the value you’re looking for. However, hashing enables data blocks to be created with a set address position in the database. This means a computer can jump directly to that position by using the hash value applied to it which is ad­dress­able in the hash table.

Digital sig­na­tures and checksums

Hashing also plays an important role as an au­then­ti­ca­tion method. For example, it can be used to create digital sig­na­tures, also known as digital fin­ger­prints. This means that the com­mu­ni­ca­tion integrity between the sender and the receiver can be confirmed. It can also be used when creating a new user account and linking them to passwords. When creating new user accounts, a hash function creates a hash value for the password that’s been chosen. For any future logins, the password entered will be compared with the hash value using hashing. When a password is reset a new hash value will also be created for the new password.

Example: With digital sig­na­tures, you can check whether messages, downloads or even websites are secure. To do this, the sender creates a hash value from messages or delivers a hash value when down­load­ing a program. The receiver then also creates a hash value using the same hash function. This is then compared with the mostly encrypted hash value that has been sent along with it. The best example of this on the web is SSL/TLS en­cryp­tion. In this case, the web server sends a server cer­tifi­cate to the browser. Hashing then creates a session key that is received, decrypted and confirmed by the server. Following this au­then­ti­ca­tion HTTPS data exchanges can take place. SFTP works in a similar fashion.

Passwords and other sensitive data

When saving sensitive data such as passwords, login and user data, hashing offers a high level of security. This is because they are not stored in their original form or “simply” encrypted in the database. Instead, the datasets are stripped down into hash values which cannot be worked out without the cor­re­spond­ing method, even when stolen. When entering a password, the password’s cal­cu­lat­ed hash value is then compared with the saved password. Hashing is also sometimes used in caches, making tem­porar­i­ly stored data such as websites or logins and payment data un­read­able to those not au­tho­rized to see it.

Example: Saving diverse content such as text documents or audio and video files can be made more secure by hashing. The binary structure of files is converted into compact hash values which are ref­er­enced in the data block they belong to. Since hash values are linked to a position in the database, the data can be found faster, and they cannot be copied in their original form or read by cyber criminals without the cor­re­spond­ing key.

What are the pros of using hashing?

The pros of hashing at a glance:

  • Sensitive data can be securely managed and takes up less space.
  • The datasets converted to hash values cannot be returned in their original form without being “decrypted” again.
  • Access to databases is quicker since hash values are as­so­ci­at­ed with positions within the database.
  • Any stolen hash values cannot be used by attackers without the cor­re­spond­ing tech­nolo­gies or in­for­ma­tion about the hash function.
  • The secure exchange of data, messages or software can be au­then­ti­cat­ed or signed by using hashing.

Hashing and blockchains

Hashing and hash functions are central com­po­nents in a blockchain. To au­then­ti­cate trans­ac­tions using crypto cur­ren­cies such as Bitcoin, hashes are created during mining. Bitcoin, for example, uses the SHA-256 hashing algorithm, con­vert­ing any length of character string into a set one, in other words, a hash, with 64 strings. They can then be used to le­git­imize, au­then­ti­cate and document official crypto trans­ac­tions, store them in the blockchain and ensure a higher level of security.

Hashing has three primary functions within the blockchain:

  • Mining: Mining on a crypto network is also known as a hash rate. It shows how many miners are active. Miners create hashes by com­plet­ing math­e­mat­i­cal cal­cu­la­tions. If the hash is valid, a trans­ac­tion block will be validated. The higher the hash rate, the more coins or tokens are created. Crypto mining is, therefore, based on trans­ac­tion hashing al­go­rithms.
  • Blockchain: Recorded and validated trans­ac­tions are doc­u­ment­ed se­quen­tial­ly as blocks. They are added to the blockchain as part of the mining process. Each block is then linked to the one before it and contains the hash value of the previous block. This prevents an invalid or damaged block from being added.
  • Key gen­er­a­tion: Hashing is also used to transfer crypto cur­ren­cies. This means that it is au­then­ti­cat­ed via hashing using a public and private key.

How safe is hashing?

Experts generally agree that using hashing is one of the safest ways to store databases and sensitive data. Hashing is not like standard en­cryp­tion since hash values do not contain any in­for­ma­tion about the original data sets and cannot be “decrypted”. Even brute force attacks which work by trying to use a com­bi­na­tion of strings until a match is found until they hit a match would need an as­tro­nom­i­cal number of tries to work.

Some bad actors also use lists of stolen hash values to compare them with rainbow tables. These are lists of stolen hash values and the access data assigned to them. If a hash value from the database matches with a hash value in the rainbow table and the assigned password, it creates a security gap. This is why it’s important, even when using hashing to regularly change passwords, carry out regular updates and use up-to-date hashing al­go­rithms. The Internet En­gi­neer­ing Taskforce (IETF) rec­om­mend­ed the following hashing al­go­rithms in 2021:

  • Argon2
  • Bcrpt
  • Scrypt
  • PBKDF2

Another way to make hashing even more secure is to use en­cryp­tion processes such as salting and peppering. With salting, every password trans­ferred to a hash value has an ad­di­tion­al, randomly created character string. By using salts of at least 16 char­ac­ters make brute force attacks prac­ti­cal­ly im­pos­si­ble and offers another level of reliable security. If a 32-character code called “pepper” is then added to all passwords, any stolen hash values with the added salt would be difficult to crack.

Go to Main Menu