{"licence":{"name":"CC BY-SA 4.0","spdx":"CC-BY-SA-4.0","url":"https://creativecommons.org/licenses/by-sa/4.0/","attribution":"Atlas, a bilingual technical dictionary (https://cmaintz.github.io/tech-atlas/)"},"id":"cs/hashing","url":{"en":"https://cmaintz.github.io/tech-atlas/en/terms/cs/hashing/","da":"https://cmaintz.github.io/tech-atlas/da/terms/cs/hashing/"},"term":{"en":"Hashing","da":"Hashing"},"aka":{"en":["hash function","cryptographic hash"],"da":["hashfunktion","kryptografisk hash"]},"domain":["cs"],"cluster":"cryptography","layer":"theory","status":"current","era":1979,"summary":{"en":"Turning any amount of data into a short, fixed-length value that changes completely if even one character changes.","da":"At lave en vilkårlig mængde data om til en kort værdi af fast længde, der ændrer sig helt, hvis blot ét tegn ændres."},"body":{"formal":{"en":"A one-way calculation that maps input of any size to a value of fixed size. The same input always gives the same result, the result cannot be turned back into the input, and finding two inputs with the same result is practically impossible.","da":"En beregning, der kun går én vej, og som laver input af enhver størrelse om til en værdi af fast størrelse. Samme input giver altid samme resultat, resultatet kan ikke regnes tilbage til input, og det er praktisk talt umuligt at finde to input med samme resultat."},"plain":{"en":"Like a fingerprint - it identifies a person without containing the person, and nobody can rebuild someone from their fingerprint.","da":"Som et fingeraftryk - det identificerer en person uden at indeholde personen, og ingen kan genskabe et menneske ud fra et fingeraftryk."},"inPractice":{"en":"A Danish web shop stores only a slow, deliberately costly hash of each customer's password. When its database is stolen, the attackers get hashes they must guess their way through one by one, not passwords.","da":"En dansk webshop gemmer kun en langsom, bevidst tung hash af hver kundes adgangskode. Da databasen bliver stjålet, får angriberne hashes, de skal gætte sig igennem én ad gangen, ikke adgangskoder."},"whyItMatters":{"en":"It is how systems spot tampering with files and messages, and how they check passwords without having to keep them.","da":"Det er sådan, systemer opdager manipulation af filer og beskeder, og sådan de tjekker adgangskoder uden at skulle gemme dem."}},"deepDive":{"en":"A cryptographic hash function H maps arbitrary-length input to an n-bit digest and is expected to provide three properties: preimage resistance (given h, finding m with H(m) = h costs about 2^n), second-preimage resistance (given m, finding m' ≠ m with the same digest costs about 2^n) and collision resistance (finding any pair costs about 2^(n/2) because of the birthday bound). That square-root effect is why a 256-bit digest gives 128-bit collision security. Non-cryptographic hashes used in hash tables and checksums (CRC32, xxHash, MurmurHash) have none of these properties; SipHash is a keyed middle ground designed to stop hash-flooding denial of service.\n\nThe standard families are SHA-2 (SHA-224/256/384/512 and the truncated SHA-512/256, NIST FIPS 180-4), built on the Merkle-Damgård construction, and SHA-3 (FIPS 202, 2015), built on the Keccak sponge, which also defines the extendable-output functions SHAKE128 and SHAKE256. BLAKE2 and BLAKE3 are widely used non-NIST alternatives. MD5 has been practically broken since Wang et al.'s 2004 collisions, and chosen-prefix MD5 collisions were used in a rogue CA certificate (2008) and in the Flame malware (2012). SHA-1 fell with the SHAttered collision in 2017 and a practical chosen-prefix collision in 2020; NIST has announced that SHA-1 must be phased out by 31 December 2030. Git still addresses objects by SHA-1 by default but uses a collision-detecting variant, with SHA-256 repositories available.\n\nMerkle-Damgård hashes leak their internal state in the output, which enables length-extension attacks: knowing H(secret ‖ m) and the length of the secret, an attacker can compute H(secret ‖ m ‖ padding ‖ m') without the secret. That is why H(key ‖ message) is not a secure MAC and HMAC (RFC 2104, FIPS 198-1) exists; SHA-3, SHA-512/256 and BLAKE3 are not vulnerable in this way.\n\nPassword storage is the most common misuse. General-purpose hashes are designed to be fast, so a GPU can try billions of SHA-256 guesses per second. Passwords need a salted, deliberately expensive password-hashing function: Argon2id (RFC 9106), scrypt, bcrypt (which silently truncates input at 72 bytes) or PBKDF2 with a high iteration count (NIST SP 800-132). The OWASP Password Storage Cheat Sheet recommends Argon2id with at least 19 MiB of memory, two iterations and parallelism 1 as a baseline. A unique random salt per password defeats precomputed rainbow tables; an optional pepper kept outside the database adds protection if only the database leaks. Hashing is also not encryption and not anonymisation: hashing a CPR number or e-mail address produces pseudonymous data under GDPR, because the small input space can be enumerated and the hashes reversed by brute force.","da":"En kryptografisk hashfunktion H afbilder input af vilkårlig længde over i en n-bit digest og forventes at have tre egenskaber: preimage-resistens (givet h koster det ca. 2^n at finde m med H(m) = h), second-preimage-resistens (givet m koster det ca. 2^n at finde m' ≠ m med samme digest) og kollisionsresistens (at finde et vilkårligt par koster ca. 2^(n/2) på grund af fødselsdagsgrænsen). Kvadratrodseffekten er grunden til, at en digest på 256 bit giver 128 bits kollisionssikkerhed. Ikke-kryptografiske hashes i hashtabeller og checksummer (CRC32, xxHash, MurmurHash) har ingen af disse egenskaber; SipHash er en nøglet mellemting designet til at stoppe denial of service via hash-flooding.\n\nDe standardiserede familier er SHA-2 (SHA-224/256/384/512 og den afkortede SHA-512/256, NIST FIPS 180-4), bygget på Merkle-Damgård-konstruktionen, og SHA-3 (FIPS 202, 2015), bygget på Keccak-svampen, som også definerer de udvidelige outputfunktioner SHAKE128 og SHAKE256. BLAKE2 og BLAKE3 er udbredte alternativer uden for NIST. MD5 har været brudt i praksis siden Wang m.fl.'s kollisioner i 2004, og MD5-kollisioner med valgt præfiks blev brugt til et falsk CA-certifikat (2008) og i Flame-malwaren (2012). SHA-1 faldt med SHAttered-kollisionen i 2017 og en praktisk kollision med valgt præfiks i 2020; NIST har meldt ud, at SHA-1 skal udfases senest 31. december 2030. Git adresserer stadig objekter med SHA-1 som standard, men bruger en variant, der opdager kollisionsforsøg, og SHA-256-repositorier er mulige.\n\nMerkle-Damgård-hashes afslører deres interne tilstand i outputtet, hvilket muliggør length extension-angreb: kender man H(hemmelighed ‖ m) og hemmelighedens længde, kan man beregne H(hemmelighed ‖ m ‖ padding ‖ m') uden at kende hemmeligheden. Derfor er H(nøgle ‖ besked) ikke en sikker MAC, og derfor findes HMAC (RFC 2104, FIPS 198-1); SHA-3, SHA-512/256 og BLAKE3 er ikke sårbare på den måde.\n\nLagring af adgangskoder er den hyppigste fejlanvendelse. Almindelige hashfunktioner er designet til at være hurtige, så et grafikkort kan afprøve milliarder af SHA-256-gæt i sekundet. Adgangskoder kræver en saltet, bevidst dyr password-hashfunktion: Argon2id (RFC 9106), scrypt, bcrypt (som stiltiende afkorter input ved 72 byte) eller PBKDF2 med mange iterationer (NIST SP 800-132). OWASP's Password Storage Cheat Sheet anbefaler som minimum Argon2id med 19 MiB hukommelse, to iterationer og parallelitet 1. Et unikt tilfældigt salt pr. adgangskode gør forudberegnede rainbow tables værdiløse; en valgfri pepper, der opbevares uden for databasen, giver ekstra beskyttelse, hvis kun databasen lækker. Hashing er heller ikke kryptering eller anonymisering: en hash af et CPR-nummer eller en e-mailadresse er pseudonyme data efter databeskyttelsesforordningen, fordi det lille inputrum kan gennemløbes, og hashene dermed kan vendes ved brute force."},"edges":[{"type":"implements","to":"security/integrity","why":{"en":"Comparing fingerprints before and after shows at once whether data was changed.","da":"Ved at sammenligne fingeraftryk før og efter ses det straks, om data er blevet ændret."},"confidence":"high","strength":"primary"},{"type":"used-with","to":"cs/password","confidence":"high","strength":"normal"},{"type":"used-with","to":"cs/tls","confidence":"high","strength":"normal"}],"depth":0,"sources":[{"title":"NIST FIPS 180-4 - Secure Hash Standard (SHS)","tier":"standard"},{"title":"Paar & Pelzl, Understanding Cryptography","tier":"textbook"}],"draft":true}