Hashing

A cryptographic hash function H maps arbitrary-length input to an n-bit digest and is expected to provide three properties: preimage resistance (given h, finding m with H(m) = h costs about 2^n), second-preimage resistance (given m, finding m' ≠ m with the same digest costs about 2^n) and collision resistance (finding any pair costs about 2^(n/2) because of the birthday bound). That square-root effect is why a 256-bit digest gives 128-bit collision security. Non-cryptographic hashes used in hash tables and checksums (CRC32, xxHash, MurmurHash) have none of these properties; SipHash is a keyed middle ground designed to stop hash-flooding denial of service.

The standard families are SHA-2 (SHA-224/256/384/512 and the truncated SHA-512/256, NIST FIPS 180-4), built on the Merkle-Damgård construction, and SHA-3 (FIPS 202, 2015), built on the Keccak sponge, which also defines the extendable-output functions SHAKE128 and SHAKE256. BLAKE2 and BLAKE3 are widely used non-NIST alternatives. MD5 has been practically broken since Wang et al.'s 2004 collisions, and chosen-prefix MD5 collisions were used in a rogue CA certificate (2008) and in the Flame malware (2012). SHA-1 fell with the SHAttered collision in 2017 and a practical chosen-prefix collision in 2020; NIST has announced that SHA-1 must be phased out by 31 December 2030. Git still addresses objects by SHA-1 by default but uses a collision-detecting variant, with SHA-256 repositories available.

Merkle-Damgård hashes leak their internal state in the output, which enables length-extension attacks: knowing H(secret ‖ m) and the length of the secret, an attacker can compute H(secret ‖ m ‖ padding ‖ m') without the secret. That is why H(key ‖ message) is not a secure MAC and HMAC (RFC 2104, FIPS 198-1) exists; SHA-3, SHA-512/256 and BLAKE3 are not vulnerable in this way.

Password storage is the most common misuse. General-purpose hashes are designed to be fast, so a GPU can try billions of SHA-256 guesses per second. Passwords need a salted, deliberately expensive password-hashing function: Argon2id (RFC 9106), scrypt, bcrypt (which silently truncates input at 72 bytes) or PBKDF2 with a high iteration count (NIST SP 800-132). The OWASP Password Storage Cheat Sheet recommends Argon2id with at least 19 MiB of memory, two iterations and parallelism 1 as a baseline. A unique random salt per password defeats precomputed rainbow tables; an optional pepper kept outside the database adds protection if only the database leaks. Hashing is also not encryption and not anonymisation: hashing a CPR number or e-mail address produces pseudonymous data under GDPR, because the small input space can be enumerated and the hashes reversed by brute force.