PASSWORD HASHING
Hashing is a cryptographic process which can be used to check the integrity and authenticity of various types of inputs. It generally used in system authentication to avoid storing plain text password in databases, it also used to check files. Documents and other types of data.
For security reasons, you may wish to store passwords in hashed type. This guards against the chance that somebody who gains unauthorized access to the info will retrieve the passwords of each user within the system. Hashing performs a one-way transformation on a password, turning the password into another String, known as the hashed password. “One-way” means it's practically not possible to travel the opposite manner - to show the hashed password back to the initial password. There are many mathematically complicated hashing algorithms that fulfil these desires. By default, the Personalization module uses the MD5 algorithm to perform a one-way hash of the passwords, and to store it in hashed form.
The hashed password value isn't encrypted before it's stored within the database. When a user tries to get access, the Personalization module takes the provided password, performs the same one-way hash and compares it to the database value. If the passwords match, then login is successful.
Difference between Encryption and Hashing:
| Hashing | Encryption |
| Process to convert information to a shorter and fixed value known as the key which used to represent the original information. | Process to encode data securely such that only a authorized user, who knows the key or password is able to retrieve the original data. |
| The whole purpose of hashing is indexing and retrieving items from the database. This process is very fast. | Purpose of encryption is to transform data to keep it secret and secure from third party. |
| A hash code or key cannot be reversed to the original information. It can only be mapped and the hash code is checked, if the hash code is the same. If the information is same it can be accessed otherwise not, Then original information cannot be retrieved. | Original information can be easily retrieved if we know the encryption key and algorithm used for encryption. |
| It is more secure in comparison to encryption. | It is less secure in comparison to hashing. |
| Generally, it tries to generate a new key for each information passed to the hash function but on rare occasions, it might generate the same key popularly known as a collision. | It will always generate a new key for each information. |
| Example : MD5, SHA256 | Example: RSA, AES and Blowfish |
1) Message Digest (MD5)
After finding severe security problems in MD4 – MD5 came as an advanced form of MD4. MD5 generates 128-bit outputs for a variable length of inputs. As a successor to MD4, it covered a lot of security threats however didn't give full data security services. though wide used, the most problems being raised with the use of MD5 are its vulnerability and collisions.
2) Tiger algorithm
Tiger cipher algorithm is a faster and more efficient algorithm as compared to the MD5 and SHA families. it's a 192-bit hashing system and is generally used in computers of the new era. Tiger2 is an advanced type of this algorithm that's even more powerful than the Tiger algorithm.
3) Message Digest algorithm (MD4)
Message Digest algorithm (MD4) is a cryptographic hash function carrying a 128-bit digest. MD4 had a security flaw because of the first collision attack found in 1995. After that, few newer attacks also affected this hash function. Ronald Rivest generated MD4 in 1990 and has influenced designs of MD5, SHA-1, and RIPEMD algorithms.
4) SHA
SHA means that Secure Hashing Algorithm; it absolutely was developed for the first time by the National Security Agency. This algorithmic rule got updates repeatedly to enhance security flaws within the previous genre. Now, SHA-2 is being used by several companies for cryptographic functions.
5) RIPMEND
Hans Dobbertin has designed the RIPMEND cryptographical hashing algorithm, that has a length of the 164-bit digest. it's created using the EU project RIPE framework.
6) WHIRLPOOL algorithm
Vincent Rijmen and Paul Barreto have designed the WHIRLPOOL algorithm, that considers any message of a length less than 2256 bits and in return offers a 512-bit message digest. the first version is termed whirlpool-0, whereas the second version is called Whirlpool-T and also the latest version is termed Whirlpool.
Purpose of Hashing:
Hashing is required at the time of comparing a huge quantity of data. you can create totally different hash values for various data. you can compare hashes too.
It is simple to keep and find records of hashed data.
You can use hashing in cryptologic applications like a digital signature.
Hashing creates random strings that help in avoiding information duplication.
Geometric hashing is used in computer graphics; it helps to find proximity problems in planes.
In Python code editor, enter the following command to import the constructor method of the
SHA-256 hash algorithm from the “hashlib” module:
from hashlib import sha256
to create an instance of the sha256 class:
h = sha256()
Now, use the update() command to update the hash object:
h.update(b'12345')
Then, use the hexdigest() method to get the digest of the string passed to the update() method:
hash = h.hexdigest()
The digest is the output of the hash function.
Finally, print the hash variable to see the hash value in the console:
print(hash)
The complete script looks like this:
from hashlib import sha256
h = sha256()
h.update(b'python1990K00L')
hash = h.hexdigest()
print(hash)
Click on the "run" button at the top of the screen. On the console, you should see the following output:
827ccb0eea8a706c4c34a16891f84e7b
To recap, you provide the hash function a string as input and get back another string as output that represents the hashed input:
Input:
12345
Hash (SHA-256):
827ccb0eea8a706c4c34a16891f84e7b
A virtue of a secure hash function is that its output is not easy to predict.
The hash for dontpwnme4 would be very different than the hash of dontpwnme5,
only the last character in the string changed and both strings would be adjacent in an alphabetically sorted list:
Input:
dontpwnme4
Hash (SHA-256):
4420d1918bbcf7686defdf9560bb5087d20076de5f77b7cb4c3b40bf46ec428b
Input:
dontpwnme5
Hash (SHA-256):
3fc79ff6a81da0b5fc62499d6b6db7dbf1268328052d2da32badef7f82331dd6
Python script used to calculate these values in case you need it:
from hashlib import sha256
h = sha256()
h.update(b'<STRING>')
hash = h.hexdigest()
print(hash)
Replace STRING with the string you desired, to hash and run it.
This property is known as the avalanche effect and it has the desirable effect that if an input is changed slightly, the output is changed significantly.
Advantages
Main advantage of hashing is synchronization.
Hash tables turn out to be more efficient than search trees or any other table lookup structure. Due to this, they are widely used in many kinds of computer software’s, particularly for associative arrays, database indexing, caches and sets.
Disadvantages
Hash collisions are practically un-avoidable. When hashing a random subsets of a large sets of possible keys.
Hash tables are quite inefficient when there are many collisions.
Hash table does not allow null values.