↓ Skip to main content
Le Site de François
  1. Index/

Hash Function (Cryptographic Hash Function)

Cryptography Security Primitives Integrity Pqc

A cryptographic hash function maps an input of arbitrary length (a file, a certificate, a password, a block of network data) to a fixed-length digest (also called a hash or fingerprint) with three security properties that distinguish it from non-cryptographic checksums. Preimage resistance: given a digest h, it is computationally infeasible to find any input m such that H(m) = h. Second preimage resistance: given an input m1, it is computationally infeasible to find a different input m2 such that H(m1) = H(m2). Collision resistance: it is computationally infeasible to find any pair (m1, m2) with m1 ≠ m2 such that H(m1) = H(m2). Collision resistance is the strongest property and implies second preimage resistance but not preimage resistance. These properties together make a hash function a one-way, tamper-evident fingerprint: two inputs that produce the same digest cannot be found by an adversary, and knowing the digest reveals nothing about the input beyond its length.

The dominant hash functions in current deployment are the SHA-2 and SHA-3 families, both NIST standards. SHA-256 (256-bit digest, part of SHA-2) is the universal default: it is the hash algorithm in TLS certificate fingerprints, the hash chained in Bitcoin blocks, the digest algorithm in sha256sum, the hash in HMAC-SHA-256 for message authentication, and the default in virtually every modern cryptographic protocol. SHA-384 and SHA-512 are SHA-2 variants with longer digests and slightly different internal state, used where a larger security margin is required (CNSA-suite requirements, ECDSA P-384 signatures). SHA-3 (also called Keccak) is structurally different from SHA-2 — a sponge construction rather than Merkle-Damgård — providing design diversity in case a weakness specific to SHA-2’s structure is found; SHA3-256 and SHA3-512 are the fixed-output variants, while SHAKE128 and SHAKE256 are XOFs (extendable output functions) that produce arbitrarily long output and are used internally in ML-KEM, ML-DSA, and SLH-DSA as the underlying primitive. SHA-1 (160-bit digest) is fully broken for collision resistance — the SHAttered attack (2017) produced a chosen-prefix collision in practical time — and is deprecated everywhere; it persists only in legacy Git object identifiers (SHA-1 is being phased out in Git’s object store in favour of SHA-256) and old TLS/SSH configurations that should be upgraded immediately. MD5 is similarly broken and should never be used for security purposes.

Hash functions appear in every layer of the infrastructure described in this glossary, usually invisibly. In PKI and X.509, the signature algorithm ecdsa-with-SHA256 means ECDSA applied to the SHA-256 digest of the certificate’s ToBeSigned structure. In TLS, the transcript hash accumulated during the handshake is the SHA-256 or SHA-384 digest of all handshake messages, used to bind the session keys to the exact exchange that produced them. In LUKS, key derivation from a passphrase uses Argon2 or PBKDF2, both of which use SHA-2 internally to produce a key of the right length from a slow, iterated hashing process. In composefs and OCI, content-addressed storage is entirely hash-based: every blob is identified by its SHA-256 digest, making the digest the canonical, immutable address of the content. In IMA, every file measurement is a SHA-256 (or SHA-512) digest extended into TPM PCR 10. In SBOM and VEX, component identity via PURL is often combined with a SHA-256 hash of the artifact as a secondary identifier. In SLH-DSA, the entire signature scheme’s security reduces to the collision and preimage resistance of the underlying hash — the algorithm’s conservative appeal is precisely that trusting SLH-DSA requires trusting only the hash function, not any new algebraic assumption. Against quantum computers, Grover’s algorithm halves the effective security of a hash function in terms of preimage resistance — SHA-256’s effective quantum security is 128 bits, sufficient but not generous — while collision resistance is more complex but generally considered to require output sizes of 384 bits or more for full quantum resistance, which is why SLH-DSA uses SHA-512 or SHAKE256 variants at its higher security levels.

Related

HMAC (Hash-based Message Authentication Code)

Cryptography Security Integrity Authentication Primitives
HMAC (Hash-based Message Authentication Code), standardised in RFC 2104 (1997) and FIPS 198-1, is a construction that produces a Message Authentication Code (MAC) by combining a cryptographic hash function with a shared secret key. A plain hash function provides integrity — any modification to a message changes its digest — but anyone can recompute the digest of a modified message, so a hash alone cannot prove that a message came from a specific party who holds a secret. HMAC adds authenticity: only a party who knows the key K can produce a valid HMAC(K, message), and only a party who knows K can verify it. The construction is HMAC(K, m) = H((K ⊕ opad) ∥ H((K ⊕ ipad) ∥ m)) — two rounds of hashing with the key XOR’d against inner and outer padding constants — a design chosen to be provably secure against length-extension attacks that affect naive H(K ∥ m) constructions with Merkle-Damgård hash functions like SHA-256. HMAC is proven secure as long as the underlying hash function is a pseudorandom function, a weaker requirement than collision resistance, meaning HMAC-SHA-256 remains secure even in scenarios where SHA-256 collision resistance might be weakened.

SHA (Secure Hash Algorithm)

Cryptography Security Hash Nist Primitives Pqc
SHA (Secure Hash Algorithm) is the name given to a series of cryptographic hash function families standardised by NIST under FIPS 180 and FIPS 202. Three generations exist with fundamentally different design lineages. SHA-1 (1995, FIPS 180-1) produces a 160-bit digest and is fully broken for collision resistance: the SHAttered attack (Google and CWI Amsterdam, 2017) produced a chosen-prefix collision — two different PDF files with identical SHA-1 hashes — using approximately 9.2 × 10^18 SHA-1 operations, within practical reach of well-resourced attackers. SHA-1 must not be used for any security purpose; it persists only in legacy Git object identifiers (SHA-1 is being phased out in Git’s object store in favour of SHA-256 under the sha256 object format) and in TOTP’s HMAC-SHA-1 inner construction (where collision resistance is not the relevant security property, but migration to SHA-256 variants is still recommended). SHA-2 (2001, FIPS 180-2 and subsequent revisions) is the Merkle-Damgård family that includes SHA-224, SHA-256, SHA-384, SHA-512, SHA-512/224, and SHA-512/256. SHA-256 and SHA-512 are the two variants in universal production use; the others serve niche roles. SHA-3 (2015, FIPS 202) is the Keccak sponge construction — structurally independent of SHA-2 — providing algorithm diversity and including fixed-output variants (SHA3-256, SHA3-512) and extendable output functions (SHAKE128, SHAKE256).

AES (Advanced Encryption Standard)

Cryptography Symmetric Encryption Nist Security Primitives
AES (Advanced Encryption Standard), standardised as NIST FIPS 197 in 2001, is the symmetric block cipher that underlies virtually all data encryption in modern infrastructure. It was selected through a five-year open competition that evaluated 15 candidate algorithms; the winner, Rijndael (designed by Joan Daemen and Vincent Rijmen), became AES. A block cipher takes a fixed-size block of plaintext and a key and produces a fixed-size block of ciphertext — AES always operates on 128-bit (16-byte) blocks, regardless of key size. Three key lengths are standardised: AES-128 (128-bit key, 10 rounds), AES-192 (192-bit key, 12 rounds), and AES-256 (256-bit key, 14 rounds), providing 128, 192, and 256 bits of security respectively against classical attacks. AES-256 is the conservative choice for data with long confidentiality requirements and is mandated by CNSA 2.0 for national security systems; AES-128 is widely deployed in TLS and provides adequate security for most workloads. The internal structure — SubBytes, ShiftRows, MixColumns, AddRoundKey — is fully public and has withstood over two decades of cryptanalysis; the best known attacks against full-round AES are theoretical and computationally infeasible, requiring work far beyond brute force but not threatening practical security.