Cryptographic Hash Functions
Hash Function Properties (One-Way)
A cryptographic hash function is a one-way mathematical function that maps data of arbitrary size to a fixed-size bit string (the "hash" or "digest"). The SHA-2 family (SHA-256, SHA-384, SHA-512) is defined in FIPS 180-4 and is widely used in TLS certificates, code signing, and password hashing.
SHA Algorithm Comparison
| Algorithm | Output (bits) | Block Size | Status | Use Case |
|---|---|---|---|---|
| SHA-1 | 160 | 512 bits | ⚠️ Deprecated | Legacy only — CVE-2017-15361 |
| SHA-256 | 256 | 512 bits | ✅ Secure | TLS, GPG, Bitcoin, JWT |
| SHA-384 | 384 | 1024 bits | ✅ Secure | TLS 1.3, ECDSA P-384 |
| SHA-512 | 512 | 1024 bits | ✅ Secure | Password hashing, archival |
| SHA-3/256 | 256 | 1088 bits | ✅ Secure | Quantum-resistant alternative |
Key Properties of Hash Functions
- Deterministic: The same input always produces the same hash output.
- One-Way (Pre-image Resistant): It is computationally infeasible to reverse a hash back to its original input.
- Avalanche Effect: A single bit change in the input completely changes the output hash.
- Collision Resistant: It is computationally infeasible to find two different inputs with the same hash.
- Fixed Output Size: Regardless of input size, SHA-256 always produces a 256-bit (32-byte) output.
⚠️ SHA-1 is Broken
SHA-1 collision attacks have been demonstrated (SHAttered, 2017). Do not use SHA-1 for digital signatures, certificates, or security-sensitive applications. Use SHA-256 or higher.