What Is a Hash Function and Can It Become Vulnerable?

Hash functions are one of the most commonly used methods of protecting data in our cybersecurity-focused world. Other than encryption, hashing is one of the more commonly used techniques, especially in databases. Hashing is a relatively simple process that works to obscure data and ensure it can’t be turned back into plaintext format. This ensures the data is truly protected and cannot be reversed no matter how much time an attacker has the data. Before we delve into security vulnerabilities with hashing, let us first take a look at hashing and how it works.           

How does Hashing Work?

The idea behind hashing is to mask data so that it cannot be read in plaintext format, which is why this method is used in databases so often. As long as the data is of a fixed length, it does not matter what the data actually is inside the database. The same functions and procedures run on a database can be utilized whether the columns containing social security numbers, for example, are valid social security numbers or not.

Since hashing creates a fixed-length hash digest, a user can hash all Personally Identifiable Information (PII), ensuring that anything that needs to be done with the database can be done properly, but if a threat actor were to gain access to the database, they would not be able to steal any PII.

Hashing itself is not an extremely complicated process, and the below image illustrates this process. What it involves is entering a string, in our example a social security number, into a hash function. This hash function then generates a randomized string, referred to as a hash digest, that can still be utilized in something like a database, while obscuring the actual data that was hashed.

As I mentioned previously, unlike encryption which is a two-way operation allowing you to decrypt the data as long as you hold the key, hashing is a one-way process. This means that even if an attacker were to gain access to your entire database, as long as any Personally Identifiable Information is hashed, they would never be able to actually use that data and steal the information that is being protected. Some other uses for hashing are message integrity, password validation, and creating digital signatures.

Hashing is the prime method used for creating digital signatures for several reasons. Client-side hashing, a method of turning a file into a string on the client machine and then hashing it there on that client machine, allows a user to send a secure file that they need digitally signed without incurring the risk of a Man in the Middle attack in the transfer of the hash to the server generating the signature.

By hashing the file on the client side, an attacker could take the hash digest generated on the client computer in transit, but still not have access to the file itself since hashing is a one-way process. Additionally, utilizing hashing in digital signatures helps secure these digital signatures as well. By signing software with a hashed signature, a user can immediately know that the signature has come from the software developer and that no malware has been placed in the software while it was in transit to the user.

What is a Hash Function?

Now that we have a better handle on how hashing itself works, let’s take a look at the hash functions themselves. You have likely heard of the different hashing algorithms, such as SHA-1, SHA-256, and SHA-512.

SHA itself stands for Secure Hash Algorithm, and the number at the end of each algorithm refers to the bit size of the hash digest that is created with the hashing algorithm in question. SHA-1 hash digests are 160 bits in size, SHA-256 hash digests are 256 bits in size, and so on. These Secure Hashing Algorithms were created due to the National Institute of Science and Technology’s standards FIPS 180-4, the Secure Hash Standard.

FIPS 180-4, or the Federal Information Processing Standards, require the use of hashing algorithms because hashes are computationally secure and because it is almost impossible to find two different messages with the same hash digest. The reason that you can’t find two different messages with the same hash digest is that if you change a single letter of a file and hash it before and after the single letter change, the hash digest that is generated will be completely different. This means that no two messages that are different can share the same hash digest.

What are some security vulnerabilities with hashing?

Now, I have spoken about how secure hashing is, but there have been vulnerabilities found in the past. Currently, the SHA-1 hashing algorithm has been deprecated, as it has been found to be weak due to processing power increasing, as well as cloud computing coming to the forefront of the computer landscape. A team at Google found that they were able to generate a file that came out to the same hash digest value when using the SHA-1 algorithm. This has caused some distress as if this is possible with SHA-1, then in the future or near future, this could occur with the currently considered secure hashing algorithms.

The problem behind these types of vulnerabilities is that a computer using SHA-1 to verify that a website is the correct website could be connecting to a malicious website instead, resulting in information being stolen, credentials being stolen, or malware being downloaded to a victim’s computer. If stronger Secure Hashing Algorithms can be broken the same way, then tools that use these in day-to–day operation could become unusable in the future. At the current time, the NIST has released SHA-3 which has made large steps to be more secure than SHA-1.

Conclusion

As we navigate the ever-evolving landscape of cyber threats, it is crucial to acknowledge potential vulnerabilities in hashing algorithms, as evidenced by the deprecation of SHA-1. At Encryption Consulting LLC, we recognize the significance of robust data protection.

Our code signing platform, CodeSign Secure, is a testament to our commitment to secure practices. Utilizing client-side hashing, virus scanning, and signature generation with hardware security modules, CodeSign Secure provides a comprehensive solution to ensure that our client’s data remains safeguarded in transit and at rest. We prioritize security to offer a quick and straightforward means of signing various file types. To inquire about any of our products or to schedule a demo of CodeSign Secure, visit our website www.encryptionconsulting.com.