Hashing: History, Types, Working & Uses of Hashing

Hashing: History, Types, Working & Uses of Hashing

Hashing is an essential tool in digital forensics and plays a crucial role in ensuring the integrity and authenticity of digital evidence. Digital evidence such as files, emails, and images, can be easily modified or tampered with, making it challenging to determine the original content of the evidence.

Hashing helps investigators to verify whether the digital evidence has been altered or tampered with since it was originally collected. 

What is Hashing?

Hashing is a process of converting an input message or data of any length into a fixed-length output, also known as a hash value, using a mathematical algorithm. The resulting hash value is unique to the input data, and any slight modification of the input data will result in a completely different hash value.

History of Hashing

Hashing has been used in computer science and cryptography for several decades, and its origins can be traced back to the 1950s. One of the earliest known applications of hashing was in a system called “Permuter,” which was developed by IBM researcher Hans Peter Luhn in 1953. The system used a hash function to compress and index large volumes of text data for efficient storage and retrieval.

In the 1960s and 1970s, researchers began to explore the use of hashing for cryptography, and the first practical cryptographic hash function, MD4, was developed by Ronald Rivest in 1990. Since then, numerous other hash functions have been developed, including SHA-1, SHA-2, and SHA-3, which are widely used in modern cryptography, digital forensics, and other computer applications.

Today, hashing is a critical component of many computer systems and applications, and its applications have expanded far beyond the storage and retrieval of text data. The use of hashing has become ubiquitous in computer security, data integrity, and authentication, and it is expected to continue to play a significant role in computer science and technology for years to come.

Hashing Algorithms

Algorithms of Hashing are a type of mathematical function used to convert any input data of arbitrary size into a fixed-size output known as a hash value or message digest. These algorithms take input data and apply a series of mathematical operations to generate a unique and irreversible digital fingerprint of the data.

The resulting hash value is typical of a fixed length, and it can be used for various applications such as data retrieval, cryptography, and authentication. Hashing algorithms are designed to be one-way functions, which means that it is computationally infeasible to retrieve the original data from its hash value.

This property makes hashing an essential tool for securing data storage and communication. In this context, the hash function is a critical component of security protocols and is used in various applications such as digital signatures, file verification, and password storage

There are several types of hashing algorithms:

1. MD (Message Digest) Algorithms: These are a series of hash functions developed by Ron Rivest, which are widely used for data integrity and authentication purposes. MD5 is the most commonly used algorithm in this category, although it is considered to be insecure due to known vulnerabilities.
2. SHA (Secure Hash Algorithm) Algorithms: These are a set of hash functions developed by the National Security Agency (NSA) in the United States. They are widely used for data security, digital signatures, and other cryptographic applications. There are several variants of SHA, including SHA-1, SHA-2, and SHA-3, SHA-256.
3. HMAC (Hash-Based Message Authentication Code): This is a type of message authentication code (MAC) that uses a cryptographic hash function and a secret key to provide data integrity and authentication. HMAC is widely used in computer networks and systems for secure data transfer and communication.
4. RIPEMD (RACE Integrity Primitives Evaluation Message Digest): These are a set of cryptographic hash functions developed by a group of European researchers. They are used for digital signatures, data integrity, and other cryptographic applications.
5. LANMAN (Local Area Network Manager): It is a legacy password hashing algorithm used by Microsoft operating systems, including Windows 95, Windows 98, and Windows NT. It was used to hash user passwords for storage and authentication purposes. However, LANMAN is considered to be a weak and insecure hashing algorithm because it splits the user’s password into two 7-character strings and applies a separate hash function to each string. This makes it vulnerable to brute-force attacks and other password-cracking techniques. As a result, Microsoft has deprecated the use of LANMAN in newer versions of its operating systems and recommends the use of stronger hashing algorithms like NTLM or Kerberos.
6. NTLM (NT LAN Manager): It is also a password hashing algorithm used by Microsoft operating systems for authentication purposes. The NTLM hash algorithm is used to create a fixed-length hash value of the user’s password, which is then stored in the Security Account Manager (SAM) database or Active Directory for later authentication. NTLM hash is considered to be relatively weak and vulnerable to various password-cracking techniques, such as brute-force attacks and dictionary attacks. As a result, Microsoft has deprecated the use of NTLM in newer versions of its operating systems and recommends the use of stronger authentication protocols like Kerberos.

How Does Hashing Work?

The working of hashing can be explained in a few simple steps:

• Input: A message or data is taken as input, which can be any size or format.
• Hash Function: A hash function is applied to the input data, which converts it into a fixed-length output, known as a hash value. The hash function is designed to be a one-way function, meaning that it is easy to compute the hash value from the input data, but it is practically impossible to compute the input data from the hash value.
• Output: The hash value is the output of the hashing process, which is a unique representation of the input data. Even a small change in the input data results in a completely different hash value.
• Verification: To verify the integrity of the original data, the input data can be hashed again using the same hash function, and the resulting hash value can be compared to the original hash value. If the hash values match, it indicates that the original data has not been tampered with and is unchanged. If the hash values do not match, it means that the original data has been altered.

Here’s an example to illustrate the working of hashing:

Let’s consider the message “Hello, world!” as the input data. We will use the SHA-256 hash function to compute the hash value of this message.

• Input: “Hello, world!”
• Hash function: The SHA-256 hash function is applied to the input data, resulting in the following hash value:

185f8db32271fe25f561a6fc938b2e264306ec304eda518007d1764826381969

• Output: The hash value is the output of the hashing process, which is a fixed-length string of characters representing the original message.
• Verification: To verify the integrity of the original message, we can hash it again using the same SHA-256 hash function, and compare the resulting hash value with the original hash value. If the hash values match, it indicates that the original message has not been tampered with and is unchanged.

Uses of Hashing

1. Message Integrity by Hashing

Hashing is used to protect message integrity by generating a fixed-size, unique digital fingerprint (also known as a hash) of the message content. The hash is generated using a one-way hash function that takes the message as input and produces a fixed-size output, regardless of the size of the input message. This output is unique for each input message, and any change in the message content will result in a different hash value.

Here’s an example of how hashing protects message integrity:

Suppose Alice wants to send a message to Bob over an insecure channel, such as the internet. Before sending the message, Alice calculates the hash of the message using a hashing algorithm, such as SHA-256. She then sends the message and the hash value to Bob.

When Bob receives the message, he calculates the hash of the message using the same hashing algorithm. He compares this hash value with the one sent by Alice. If the two values match, Bob can be sure that the message has not been tampered with during transmission. If the hash values do not match, Bob knows that the message has been modified, and he should discard it.

2. Password Validation

Hashing is also used to validate passwords in computer systems. When a user creates a password, it is hashed using a one-way hash function and stored in a database. When the user logs in, the entered password are hashed and compared to the stored hash value. If they match, the login is successful, otherwise, it fails.

Here’s an example of how hashing validates passwords:

Suppose Alice creates a new account on a website and sets her password to “password123“. The website uses the SHA-256 hashing algorithm to store password hashes in its database. When Alice creates her account, her password is hashed using SHA-256 and the resulting hash value is stored in the database. When Alice logs in to the website, she enters her password “password123”.

The website hashes the entered password using SHA-256 and compares the resulting hash value with the stored hash value in the database. If the two hash values match, the website grants access to Alice’s account.

3. File Integrity by Hashing

Hashing is often used to protect file integrity, ensuring that the file has not been tampered with or altered in any way. This is achieved by computing the hash value of the original file and then verifying it later to ensure that the file has not changed.

Here’s an example of how hashing protects file integrity:

Suppose Bob wants to share a file with Alice. Before sending the file, Bob computes the hash value of the file using a secure hashing algorithm like SHA-256. He then sends both the file and the hash value to Alice. When Alice receives the file and the hash value, she also computes the hash value of the file using the same hashing algorithm.

She then compares the computed hash value with the hash value provided by Bob. If the two hash values match, Alice can be confident that the file has not been tampered with or altered during transit.

4. Blockchain 

Hashing plays a crucial role in the functioning of blockchain technology. Blockchain is essentially a decentralized and distributed ledger that records transactions on a network of computers. Hashing is used to create a unique and tamper-proof digital fingerprint of each transaction, which is then added to the blockchain.

When a transaction occurs on the blockchain, it is broadcasted to a network of nodes for verification. Each node verifies the transaction and then computes its hash value using a secure hashing algorithm like SHA-256. The hash value is then added to the block that contains the transaction.

The block also contains the hash value of the previous block, creating a chain of blocks (hence the name “blockchain”) that are linked together by their hash values.

Because each block contains the hash value of the previous block, any attempt to modify the contents of a block would require the modification of all subsequent blocks in the chain, making it practically impossible to tamper with the data on the blockchain without being detected.

Conclusion

In digital forensics, it is critical to follow the rule of not directly examining or analyzing the original digital evidence. This is because performing such actions can alter the date, time, or file properties, such as the MAC (Modified, Accessed, and Created) timestamp, leading to the evidence being deemed tampered with and therefore inadmissible in court.

Hashing ensures that the original evidence remains unchanged and preserves its integrity. By using hashing, investigators can verify that the evidence has not been tampered with and maintain its admissibility in court.

Also Have a Look at:

• Difference between Autonomous and Automate Processes
• Optus Data Breach Case
• Pegasus Spyware Controversy and its Investigation