Hashing | OCR H446

Learning Objectives

By the end of this topic you will be able to:

Define a hash function and describe the properties of a good hash

Explain how hashing is used for password storage

Explain how hashing is used for data integrity verification

Describe collisions and salting

Hash Functions

What is a Hash Function?

A hash function takes an input of any size and produces a fixed-length output (the hash or digest). The same input always produces the same hash. It is a one-way function — it is computationally infeasible to reverse the hash to find the original input.

Properties of a Good Hash

Deterministic: same input → always same output

Fixed output length regardless of input size

Avalanche effect: tiny input change → completely different hash

Collision-resistant: near-impossible to find two inputs producing the same hash

Examples

MD5 (128-bit, now insecure), SHA-1 (deprecated), SHA-256 (current standard), SHA-3. SHA-256 is used in digital certificates, blockchain, and password storage.

Password Storage

Hashing for Password Storage

Passwords must never be stored in plaintext. Instead, the hash of the password is stored. When a user logs in, the entered password is hashed and compared against the stored hash.

Attack resistance: if the database is breached, attackers get hashes, not passwords. Since hashing is one-way, they cannot directly reverse hashes to get passwords.

Dictionary/rainbow table attacks: attackers pre-compute hashes of common passwords and compare. Mitigated by salting.

Salting: a unique random value (salt) is added to each password before hashing — hash(password + salt). Even if two users have the same password, their stored hashes will differ. The salt is stored alongside the hash.

Data Integrity

Hashing for Data Integrity

Hash functions are used to verify that data has not been altered in transit or storage. A checksum hash of the data is computed before transmission; the recipient recomputes the hash and compares it.

File downloads: websites publish the SHA-256 hash of a file. Users compute the hash of the downloaded file; if it matches, the file is intact and unmodified.

Digital signatures use hashing: the sender hashes the message, encrypts the hash with their private key, and sends both the message and the encrypted hash. The recipient verifies by decrypting and recomputing the hash.

Collision: when two different inputs produce the same hash. Good hash functions make collisions extremely rare. A collision in a security context could allow an attacker to substitute malicious data.

Exam Practice

OCR H446 Style · 4 marks

Explain why salting is used when storing passwords. Include what a salt is and how it protects against a specific type of attack.

[4 marks]

A salt is a unique, randomly generated value added to each password before hashing, so the stored value is hash(password + salt).

Without salting, two users with the same password would have the same hash, revealing that their passwords match.

Salting defeats rainbow table/dictionary attacks — a rainbow table pre-computes hashes of common passwords, but the salt means each hash is unique even for identical passwords, making pre-computed tables useless.

The salt is stored alongside the hash in the database; it is not secret but ensures each hash is unique, forcing attackers to crack each password individually.

Common Mistakes

Don’t Lose Marks

Confusing hashing with encryption — encryption is reversible (with the right key); hashing is one-way and cannot be reversed. Hashing is not encryption. This is one of the most common errors at A Level.

Saying the salt is secret — the salt does not need to be secret. It is typically stored in plaintext alongside the hash. Its purpose is uniqueness, not secrecy. The security comes from the one-way hash, not the salt being hidden.

Saying hashing compresses data — compression reduces file size and is reversible. Hashing produces a fixed-length digest for integrity/security and is not reversible. Do not conflate these two concepts.