Hey everybody welcome to the next video.
So in this video are we talking about shock.
So what is Shaw.
Shaw stands for secure hashing algorithms.
It is commonly used to hash and hold passwords.
Now as I said in multiple videos this is a one way function similar to empty five.
Now the common uses for this is it will hash a value a password upon being set then it will stored in
the database.
And when you go to log in it runs your plaintext password that you submitted through the same hash and
then it checks against the database to see if it's there.
Now when you start looking deeper into shore and how it works you're going to start seeing stuff related
to something called assault.
Now what assault is either appended or pretended to the end or beginning of the data in this case let's
let's say a password and encrypts it from certain encrypted hashes it with that salt.
The reason this is done is because if you hash the password directly let's say you hash the word password
all lowercase the same that hash is going to be the same regardless of what system you you hash the
word password on.
So it's going to be an easy thing to identify.
So someone can take a word list of just random words and pass was going to be one will say the whole
dictionary.
So grab the dictionary and generate a sha hash or shall one shot two or three.
We'll go over that in a second.
They generate a short hash of the word of everyone in the dictionary and then they just look up what
you what you've said what you've said.
Now you've used the word password as your password all lowercase.
It's in the dictionary.
They're going to find a match to the to the hashes.
Now if you append to salt or prepared to salt which is a random fixed data that the application is using.
So if the application uses a salt of testing.
Right.
So it will append testing to password.
So when they run through their their word password to assure hashing function and they look at the output
of the applications it will not be the same.
Even though you use the same password.
This is important sometimes application will use a custom salt per user.
So when it goes and generates a Hash again it will grab the salt for that user append it or pretty pendant
and then hash it and then compare just an extra way of securing things.
Now there are three different types of shore the shore one shore two inshore three shore one not used
anymore.
Very often now shot two that's actually should be shot to 24 four not two thousand twenty four.
Sorry about that.
Then there's shore 386 and then shore 512.
Now it's important to know that shore too is the most commonly used nowadays and what you're going to
run into shore 3 not so much but it's will be in the future.
Now a little bit about more about shore now shore one shot to shore three work pretty much the same
with some differences.
I'm not going to go over the specific differences because it's all on the math side of things.
Again nobility video above or a link to a Web site above the video so you can go over more detail on
the math side.
Now Shaw one used to output a hundred and sixty bit message digest.
So it's a little bit bigger than some of the arms are a little bit smaller than the empty five now shot
two and three output either a two hundred twenty four bit string message digest or 256 bit message digest
depending on which which shore that you're using the shore too.
Now again shore one is no longer secure there have been ways to brute force the hash out and reverse.
Now it's important that you take a second here and look up some more information on shore to shore 256
example shore 512 get familiar with shore you're going to see it quite often and in a lot of applications
shock and also use similar to MDT five where you can generate the hash for a file and then you can compare
it as well.
There are applications that use shore instead of empty five just because of the issues with empty five.
So keep that in mind go ahead and do it a little bit more extra research onshore specifically.
It's always a good thing to learn about.