In this lecture we'll talk about the applications of hash algorithms.
You'll find hashes in many areas of computer science.
Hashes are everywhere.
They're a critical part of password systems, digital signatures, security certificates, blockchain technology,
or even how the ATM of your bank verifies the PIN of your credit card
when you want to withdraw some cash. Let's see the most useful use-cases! Cryptographic hash functions
are very commonly used in password verification. For security reasons
password are not stored in clear text. If an attacker was to break into the system and steal the file or
the database where passwords are stored,
the attacker could then access each user account. A more secure way to store a password is to transform
it into data that cannot be converted back into the original password and this is exactly what
hashing does; so instead of saving the clear text password the system will calculate its hash and store
that hash.
This is how Linux, Windows, databases and all other web applications work. Let's see
the contents of etc/shadow.
Let's take a look at this line.
This is the saved hash of the password of user Kali. No one can find out what is its password. By
the way
there is another dedicated lecture where I have explained in great detail how the Linux systems stores
the user's passwords. I'd recommend you to watch that video as well. Okay!
Later when the user wants to authenticate he will enter his clear text password.
The system will immediately calculate the hash of the entered password and compare it to the hash saved
in the password file; if the hashes are equal
it means that the user has entered the correct password.
Remember that each input, in this case password, has its own unique hash which is deterministic. A wrong
password would have given another hash.
Sometimes the password is combined to another piece of random data called salt.
In this example this is the salt and hashed altogether. Due to rainbow tables hashing alone is not sufficient
to protect passwords for mass exploitation.
There is another section on rainbow tables and I recommend you to watch those videos as well.
Let's move on and talk about File Integrity. Hashing is also used to verify the integrity of a file after
it has been transferred from one place to another. When downloading an important document,
new software or when updating existing one you want to ensure that your installation is safe, unaltered
and from a reputable source. Let's
imagine you want to install a new Linux distribution on your computer.
Normally you go and download data from a mirror which is an http server closer to you geographically.
It would be easy for a malicious entity to modify the installation kit so that it contains exploits
or malware and host it unofficially. To prevent this issue
you'll generate the hash or checksum of your downloaded ISO file and verify that it matches the
hash published on the official website.
In this example with Kali Linux - this hash. If the hashes are equal it confirms the ISO file hasn't
been tampered with or corrupted.
But if they are not equal it means your downloaded images
integrity is compromised.
Maybe it was corrupted during the download process.
Remember that if a single bit is different in your downloaded file the file has a different hash than
the one calculated by the development team and published online.
Let me show you how this works!
I've already downloaded CentOS 8 boot ISO file and I want to check its integrity.
It's on my desktop.
This is the file! I want to be sure that the file hasn't been tampered with or corrupted.
Cenos.org has listed
checksum information via https in the release notes for each software release.
My release is 8.1911
and this is the web page for that release. I will calculated the sha256 hash of the downloaded
file and then compare the hash to the one published online.
If they are the same I have verified the integrity of the ISO file and they can install it without any
risk.
Sha256sum and the file! it's calculating the hash!Okay.
This is the hash; let's check it against the hash published online.
Okay.
It starts with 7fea13202bf and so on
It's the same hash! Another application of hashes is the process of digital signing! Hashing is a critical
component of the digital signing process.
In fact the digital signature of a file is the hash of the file encrypted with the private key of the
one that signs.
Let's take a look at the digital certificate of Google.com.
We see that the certificate authority signed it by using the same sha256 and RSA algorithms. The last
application of hashes
I'm gonna talk about in this lecture is related to data structures of programming languages Python dictionaries
and sets or go maps are implemented as hash tables.
We won't go deeper into it now.
You should only know that they provide constant time look up and insertion time on average.