hashing

Hashing

1. Definition

A hash function takes an input of any size and produces an output of fixed size, called the hash, digest or fingerprint. A cryptographic hash function must additionally satisfy security properties that make it usable for integrity, signatures, passwords and blockchains.

2. Properties of a Cryptographic Hash Function

1. Deterministic — the same input always gives the same output.
2. Fast to compute — cheap for any input size.
3. Fixed-length output — 256 bits for SHA-256, whatever the input (a one-line message or a 4 GB video).
4. Pre-image resistance (one-way) — given the hash, it is computationally infeasible to recover the input: hashing is not encryption and cannot be "decrypted".
5. Second pre-image resistance — given an input, it is infeasible to find a different input with the same hash.
6. Collision resistance — it is infeasible to find any two different inputs with the same hash. By the birthday paradox, a collision becomes likely after about $2^{n/2}$ attempts (≈ 2¹²⁸ for SHA-256).
7. Avalanche effect — changing one bit of the input changes about half the output bits, so the new hash looks completely unrelated.

3. Common Hash Algorithms

Algorithm	Output	Status / use
MD5	128 bits	Broken (practical collisions since 2004) — legacy checksums only
SHA-1	160 bits	Broken for collision resistance (SHAttered, 2017); still seen in legacy systems (Git moved to collision detection)
SHA-256	256 bits	Standard and unbroken; Bitcoin, TLS certificates, file integrity
SHA-512 / SHA-2 family	224-512 bits	General-purpose, widely used
SHA-3 (Keccak)	224-512 bits	Sponge construction; not affected by length-extension attacks; Ethereum uses Keccak-256
RIPEMD-160	160 bits	Used with SHA-256 (as HASH160) to create Bitcoin addresses
BLAKE2 / BLAKE3	256-512 bits	Very fast, used in Zcash, IPFS, modern apps
bcrypt / scrypt / Argon2	~256 bits + salt	Password hashing — deliberately slow and salted to defeat brute force and rainbow tables
HMAC	Same as the hash	Keyed hash (e.g. HMAC-SHA256) used for message authentication and API signatures

4. Verified Examples (SHA-256)

  input: (empty string)  →  e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
  input: "abc"           →  ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad

Note how a three-character input produces a 64-hex-digit output, and how a one-character change ("abc" → "abd") produces a completely different digest — the avalanche effect in action. There is no way to go back from these digests to the text; they can only be compared or attacked by brute force.

5. Where Hashing Is Used in Blockchain

Use	How
Linking blocks	Each block header stores the hash of the previous block — the chain is a hash chain
Merkle root	Pairs of transaction hashes are hashed repeatedly until one root remains, summarising all transactions
Transaction ID (txid)	The double SHA-256 of the signed transaction identifies it uniquely
Mining / Proof of Work	Miners search for a nonce that makes the block hash smaller than the target
Address generation	Public key → SHA-256 → RIPEMD-160 (HASH160) → Base58Check address
Digital signatures	The hash of the message is signed (ECDSA/secp256k1), not the whole message — short, fixed-size signature input
Integrity of state	Ethereum stores a state root: any change to balances changes the root

Because the whole security of "you cannot rewrite history" rests on collision resistance and pre-image resistance, a break in the hash algorithm (as happened to MD5 and SHA-1) would be a break in the blockchain.

6. Hashing vs Encryption vs Encoding (a favourite exam question)

Basis	Hashing	Encryption	Encoding
Reversible?	No (one-way)	Yes, with the key	Yes, trivially
Key required?	No (or a key in HMAC)	Yes	No
Purpose	Integrity, fingerprints, passwords, PoW	Confidentiality	Data format/transport compatibility
Output size	Fixed	Roughly proportional to input	Proportional to input (Base64 ≈ +33%)
Examples	SHA-256, bcrypt, HMAC	AES (symmetric), RSA/ECC (asymmetric)	Base64, URL-encoding, ASCII, UTF-8
Typical use	Blockchains, file checksums, password storage	HTTPS/TLS, disk encryption, VPN	Sending binary in e-mail/JSON

7. Other Applications

Password storage (salted hashes: hash = H(salt + password), so identical passwords give different digests and rainbow tables fail) · file and download integrity (checksums published alongside ISOs) · digital signatures and certificates (sign the hash) · HMAC for API authentication and message integrity · deduplication and content addressing (IPFS, Git commit IDs, BitTorrent) · hash tables in data structures (non-cryptographic, fast) · Bloom filters (membership testing) · forensic evidence integrity (a hash proves a disk image was unmodified) · proof-of-data-possession and blockchain mining.

8. Attacks and Cautions

Brute force on weak secrets (a short password's hash can be tried exhaustively — hence salts and slow KDFs) · rainbow tables (precomputed hash lists — defeated by salting) · collision attacks (MD5, SHA-1; the reason SHA-256/3 are mandated now) · length-extension attacks on Merkle-Damgård constructions (avoided by HMAC or SHA-3) · chosen-prefix collisions used in forged certificates · quantum computing — Grover's algorithm halves the effective pre-image security ($2^{256}$ → $2^{128}$ attempts), still infeasible, but signatures like ECDSA need post-quantum replacements. The practical rule: use SHA-256/SHA-3/BLAKE2 for integrity, Argon2/bcrypt/scrypt for passwords, and never invent your own scheme.

9. Exam Points

• Define hashing and list the properties of a cryptographic hash function — 5-7 marks, almost certain.
• Differentiate hashing, encryption and encoding — 5 marks, very frequent.
• Compare MD5, SHA-1, SHA-256, bcrypt/Argon2 and state where each is used — 5 marks.
• Explain the avalanche effect with an example — 3 marks.
• Explain how hashing provides integrity and how it is used in a blockchain (block linking, Merkle root, PoW, addresses) — 5-7 marks, frequent.
• What is a collision? What is the birthday-paradox bound? — 3-5 marks.
• Why must passwords be salted and hashed with a slow function? — 3 marks.