A hash is a number generated from the information inside a file, maybe a clear text file. The resulting string is a fixed length, and will vary widely with small variations in input. Hashing differs from encryption and does not use a process to encrypt and decrypt data. Hashing, however, is a one-way function that scrambles plain text to produce a unique message digest. With a properly designed algorithm, it works in a one-way direction, hence there is no way to reverse the hashing process to reveal the original password:
Let's understand the working.
A user enters a password and a User ID in a browser and sends it to the authentication server over a secure channel. The server uses the User ID to look up the associated message digest. The password submitted by the user is then hashed with the same algorithm, and if the resulting message digest matches the one stored on the server, it is then authenticated.
Some of the popular Hashing Algorithms are:
- MD Family: MD2, MD4 and MD5 (1989 -1992). All of these were 128 bit hash functions. MD5 is the most famous hash algorithm. MD6 also came into the industry but never gained popularity and was replaced by SHA3.
- SHA Family: There are four versions of SHA. This includes SHA0 (most vulnerable), SHA1 (most popular), SHA2 (widely deployed) and SHA3, which was introduced in 2012.
- AES Family: AES comes with three block ciphers. This includes AES-128, AES-192 and AES-256. Each cipher encrypts and decrypts data in blocks of 128 bits using cryptographic keys of 128, 192 and 256 bits.