What it means
A cryptographic hash maps input data to a fixed-length digest. The same input and algorithm produce the same digest, while changing the input should produce a different result with overwhelming probability for a suitable algorithm. Hashing is not reversible encryption and does not make a document confidential. Comparing a file with a trusted expected digest can help detect alteration, but an attacker who can replace both the file and the expected value can defeat that comparison. Password verification requires a different design: a salted, deliberately expensive password-hashing algorithm, rather than a fast general-purpose hash alone.
AN ILLUSTRATIVE SCENARIO
Checking an approved software download
A university IT team downloads an installation image. A technician compares its digest with the value obtained through an authenticated publisher channel before using the image. A mismatch stops deployment for investigation. A match supports confidence that the bytes match that published artifact; it does not establish that the software contains no vulnerabilities.
Put it to work
- State the purpose: checking file integrity, identifying duplicate content, verifying a signature, or storing password verifiers. Select the appropriate established construction rather than using one hashing recipe for all of them.
- For file checks, obtain the expected digest from a trustworthy source and record the algorithm. Keep the reference protected from the same modification path as the file being checked.
- For password storage, use a supported password-hashing library with unique salts and suitable resource-cost settings. Plan performance testing and upgrades; do not invent a password-storage format or substitute raw SHA-256.
How to check your work
Change one byte in a test file and confirm verification fails. Then check how the expected digest is authenticated. For password storage, verify library configuration and salt handling with test accounts without printing passwords or production verifiers.
Connect the ideas
- Integrity
The property that data and processes remain complete and unaltered except by authorized action.
- Encryption
Transforming data so only holders of the appropriate key can read it, protecting confidentiality in transit or at rest.
- Non-repudiation
Evidence supporting a claim that a particular party originated or approved something, so a later denial can be evaluated. Reliable identity binding and record integrity matter.