🔒 Pro · Component 1 · 1.3.1 Compression, Encryption and Hashing
1.3.1c Hashing
OCR H446 · A Level Computer Science · ~11 min read
Notes
—
Video
—
Slides
—
Worksheet
—
Quiz
What is Hashing?
A hash function is an algorithm that takes an input of any size and produces a fixed-length output called a hash, hash value, or message digest. Hashing is a one-way process — it is computationally infeasible to reverse it to find the original input from the hash value alone.
Properties of a Good Hash Function
Deterministic: the same input always produces the same hash output.
Fixed output size: regardless of input length, the output is always the same size (e.g. SHA-256 always produces 256 bits).
One-way (pre-image resistant): given a hash value, it is computationally infeasible to reverse-engineer the original input.
Avalanche effect: a tiny change to the input (even a single bit) produces a completely different hash — the output appears random and unrelated to the original.
Collision resistant: it should be computationally infeasible to find two different inputs that produce the same hash output. (A collision is when two different inputs hash to the same value.)
Efficient: computing the hash should be fast for any input size.
Common Hash Algorithms
Algorithm
Output Size
Status
Notes
MD5
128 bits (32 hex chars)
Broken — do not use for security
Collisions found; still used as a checksum for non-security purposes
SHA-1
160 bits (40 hex chars)
Deprecated — broken
Collisions demonstrated; replaced by SHA-2
SHA-256
256 bits (64 hex chars)
Current standard
Part of SHA-2 family; widely used in TLS, digital signatures, Bitcoin
SHA-512
512 bits (128 hex chars)
Current standard
Stronger; used where higher security is needed
Uses of Hashing
1. Storing Passwords Securely
Websites must never store passwords in plaintext. Instead:
When a user sets a password, the system hashes the password and stores only the hash.
When the user logs in, the entered password is hashed and compared with the stored hash.
If they match → login accepted. If not → rejected.
Even if the database is stolen, the attacker sees only hashes — they cannot reverse them to get the original passwords.
Salting: a salt is a random value added to the password before hashing. This prevents rainbow table attacks (precomputed tables of hash values for common passwords). Each user gets a unique salt, so identical passwords produce different hashes. The salt is stored alongside the hash (not secret — its purpose is uniqueness, not secrecy).
2. Data Integrity / Checksums
Hashing is used to verify that data has not been corrupted or tampered with during transmission or storage:
The sender computes a hash of the data and sends both the data and the hash.
The receiver independently hashes the received data and compares it with the received hash.
If hashes match → data arrived intact. If hashes differ → data was corrupted or tampered with.
Examples: file downloads (SHA-256 checksum published alongside), ISO images, software releases.
3. Digital Signatures
As covered in 1.3.1b, a digital signature involves hashing the message and encrypting the hash with the sender's private key. The hash ensures that even small changes to the message are detected (due to the avalanche effect).
4. Hash Tables (Data Structure)
Hash functions are also used in hash tables (covered in 1.4.2e). A hash function maps a key to an index in an array, providing O(1) average-case lookup. This is a different application from cryptographic hashing.
A rainbow table is a precomputed database mapping common passwords to their hash values. An attacker who steals a password database can look up hashes to find the original passwords.
Salting defeats rainbow tables: by adding a unique random salt to each password before hashing, two users with the same password produce different hashes — so the attacker cannot use a precomputed table. They would have to brute-force each password individually.
Example without salt: password "letmein" always hashes to the same value — easily looked up in a rainbow table.
Example with salt: "letmein" + random salt "a8f3k9" → completely different hash; "letmein" + different salt "x7m2q1" → another different hash.
Exam tip: Know the key properties of hash functions: one-way (cannot reverse), fixed output size, deterministic, and avalanche effect (small input change → completely different hash). These are frequently examined.
Exam tip: Know WHY salting is used — it prevents rainbow table attacks by ensuring identical passwords produce different hashes for different users. State clearly: the salt is stored with the hash (not secret).
⚠ Common Mistakes
Saying hashing is the same as encryption — hashing is IRREVERSIBLE (one-way); encryption is REVERSIBLE with the correct key. Never say a hash can be 'decrypted'.
Saying the salt must be secret — the salt does NOT need to be kept secret. Its purpose is to make each hash unique, preventing rainbow tables. The salt is stored alongside the hash in the database.
Confusing a collision with the avalanche effect — a collision is two DIFFERENT inputs producing the SAME hash (bad — a weakness). The avalanche effect is a SMALL change to the input producing a COMPLETELY DIFFERENT hash (good — a desirable property).
✓ Notes completed!
▶
Video coming soon
Click to advance · Arrow keys also work
Click slide or press arrow keys to navigate
✍
Worksheet — 1.3.1c Hashing
8 questions · 20 marks · instantly marked
Q1State FOUR properties that a good cryptographic hash function must possess.[4 marks]
✓ Mark scheme
Any 4 from: deterministic — same input always produces same output [1]; fixed output size — output is always the same length regardless of input size [1]; one-way/pre-image resistant — computationally infeasible to reverse the hash to find the original input [1]; avalanche effect — a tiny change to the input produces a completely different hash [1]; collision resistant — computationally infeasible to find two different inputs that produce the same hash [1]; efficient — hash should be computed quickly [1].
Q2Explain how hashing is used to store passwords securely in a database. Include in your answer what is stored and what happens when a user logs in.[3 marks]
✓ Mark scheme
When a user sets a password, the system hashes it and stores only the hash in the database — the plaintext password is never stored [1]; when the user logs in, they enter their password; the system hashes the entered password and compares it with the stored hash [1]; if the hashes match, access is granted; if not, access is denied; even if the database is stolen, an attacker sees only hashes and cannot reverse them to get the original passwords [1].
Q3Explain what a 'rainbow table' attack is, and describe how 'salting' passwords prevents it.[4 marks]
✓ Mark scheme
A rainbow table is a precomputed database of hash values for many common passwords — an attacker who steals a hashed password database can look up the hash values in the table to identify the original password [1]; without salting, all users who share the same password produce the same hash — so one rainbow table lookup can crack many accounts [1]; salting: before hashing, a unique random value (the salt) is appended to each user's password; different users have different salts, so even identical passwords produce completely different hashes [1]; the attacker's rainbow table is useless because it was not computed with those specific salts — they would need to brute-force each password individually [1].
Q4Distinguish clearly between hashing and encryption. State three differences.[3 marks]
✓ Mark scheme
Any 3 from: reversibility — hashing is one-way (cannot be reversed to find input); encryption is reversible with the correct key [1]; key requirement — hashing requires no key; encryption requires a key (symmetric or asymmetric) [1]; output size — hashing always produces a fixed-length output regardless of input size; encryption output is proportional to input size [1]; purpose — hashing is used for integrity checking and password storage; encryption is used for confidentiality (keeping data secret) [1]; you cannot 'decrypt' a hash — but you can decrypt ciphertext [1].
Q5Describe how hashing is used to verify the integrity of a downloaded file.[3 marks]
✓ Mark scheme
The file creator computes a hash of the file (e.g. SHA-256) and publishes it alongside the download link [1]; after downloading, the user also computes the hash of the downloaded file using the same algorithm [1]; if the computed hash matches the published hash, the file is intact and unmodified; if the hashes differ, the file was corrupted during download or tampered with (e.g. replaced with malicious software) [1].
Q6What is the 'avalanche effect' in hashing? Why is this property important?[2 marks]
✓ Mark scheme
The avalanche effect means that even a tiny change to the input (e.g. changing a single character or bit) produces a completely different and seemingly random hash output — there is no discernible pattern between the two hashes [1]; this is important because it means an attacker cannot make small changes to the input and predict how the hash will change — they cannot use the hash to learn anything about the input, and any tampering with data will be immediately detected [1].
Q7Explain why storing passwords as MD5 hashes (without salting) is now considered insecure. Name TWO reasons.[2 marks]
✓ Mark scheme
Any 2 from: MD5 has known collision vulnerabilities — two different inputs have been found to produce the same MD5 hash, making it cryptographically broken [1]; without salting, all users with the same password produce identical MD5 hashes — a rainbow table attack can crack many accounts at once by looking up the hashes [1]; MD5 is fast to compute — attackers can run billions of hash attempts per second on modern GPUs, making brute-force and dictionary attacks feasible [1].
Q8SHA-256 is described as 'fixed output size'. What does this mean in practice, and why is this a useful property?[2 marks]
✓ Mark scheme
Fixed output size means SHA-256 always produces a 256-bit (64 hexadecimal character) hash regardless of input length — whether the input is a single character, a 1 GB video file, or a terabyte of data, the hash is always exactly 256 bits [1]; this is useful because it allows hashes to be compared in constant time and stored in a consistent, predictable space; it also means a hash cannot reveal the size or other properties of the original data [1].
Topic Quiz
1 of 15
You scored
out of 15
🎯
Mini Test — 1.3.1c Hashing
10 questions · 10 marks · 10 minutes
5 MCQ + 5 short answer
⏱10:00
10 marks
Section A — Multiple Choice
Q1Which of the following best describes a hash function?
Q2The 'avalanche effect' in hashing means:
Q3What is a 'collision' in the context of hash functions?
Q4Which of the following is the current standard cryptographic hash algorithm for security applications?
Q5A 'salt' added to a password before hashing is used to prevent:
Section B — Short Answer
Q6State why hashing is described as 'one-way'.
Mark schemeGiven a hash output, it is computationally infeasible to work backwards to find the original input. The function cannot be reversed — you cannot retrieve the plaintext from the hash alone. [1 mark]
Q7Why do websites store the hash of a password rather than the password itself?
Mark schemeIf the database is stolen, attackers see only hash values. Since hashing is one-way, they cannot reverse the hashes to find the original passwords. The plaintext password never needs to be stored or transmitted. [1 mark]
Q8Give one difference between hashing and encryption.
Mark schemeHashing is one-way — the hash cannot be reversed to find the original input. Encryption is reversible — ciphertext can be decrypted to recover the original plaintext using the correct key. OR: Hashing requires no key; encryption requires a key. [1 mark]
Q9Explain how a salt prevents a rainbow table attack.
Mark schemeA rainbow table contains precomputed hashes for common passwords. By adding a unique random salt to each password before hashing, the same password produces a different hash for each user. The precomputed table does not contain these salted hashes, making it useless. [1 mark]
Q10How can hashing be used to verify the integrity of a file download?
Mark schemeThe publisher computes and publishes a hash of the file. After downloading, the user hashes the downloaded file with the same algorithm. If the two hashes match, the file is intact. If they differ, the file was corrupted or tampered with. [1 mark]