Lessons · Cybersecurity · hashing versus encryption
Hashing is not encryption
Encryption is a lock you can open with the key; a hash is a one-way fingerprint that cannot be turned back into the data, and the same input always gives the same fingerprint.
Hone is a place to practise a career, one idea a day. This is one of its lessons, written out in full and free to read without an account.
What it is for
The web application stored passwords encrypted with a key kept in the same folder. When the folder was copied, every password was readable. Stored as salted hashes, the same copy would have been a list of fingerprints nobody could turn back.
How to think about it
Ask whether you will ever need the original back. Yes, so encrypt and guard the key. No, you only need to check that something matches, so hash. Passwords are checked and never read back. Files are fingerprinted to prove they have not changed.
Worked example
Encryption: data plus key gives ciphertext, and ciphertext plus key gives the data backTwo directions. The key is the secret.
Hashing: data gives a fixed-length fingerprint, and there is no way backOne direction. Change one bit of the input and the fingerprint is completely different.
Login: hash what was typed and compare it with the stored hashThe password itself is never stored and never read.
Salt: a random value added before hashing and stored beside itSo two people with the same password get different hashes.
Your turn
Passwords must be checked but never read back. Write which of the two you store them with.
store passwords as a
Solve one, graded on the server
The trap
Saying 'we encrypt our passwords'. Anything that can be decrypted can be read by whoever holds the key, and the key is always somewhere.