Cryptographic Hash Functions Explained: MD5, SHA-256, and Password Security.
An introduction to one-way cryptographic hash functions, the avalanche effect, collision attacks, and why passwords must use salted key derivation algorithms.
1. What Makes a Function Cryptographic?
A hash function takes an arbitrary block of binary data (whether a single letter or a 50GB database backup) and computes a fixed-length string of bits, known as a hash digest or checksum. While general hash functions (like CRC32) are designed for speed in hash tables and error detection, cryptographic hash functions must satisfy three mathematical requirements:
- Pre-image Resistance (One-Way): Given a hash output
h, it must be computationally infeasible to determine the original inputmsuch thathash(m) = h. - Second Pre-image Resistance: Given a specific input
m1, it must be computationally infeasible to find another distinct inputm2such thathash(m1) = hash(m2). - Collision Resistance: It must be computationally impossible to find any two arbitrary, distinct inputs
m1andm2that produce the identical hash digest.
2. The Avalanche Effect
A hallmark of secure cryptographic hash functions (such as the Secure Hash Algorithm family, SHA-2 and SHA-3) is the avalanche effect. If you modify a single bit in the input data, the output hash changes drastically and unpredictably (typically flipping ~50% of the output bits):
3. Why Fast Hashes Are Dangerous for Passwords
General-purpose cryptographic hashes like SHA-256 and MD5 are designed to be extremely fast. Modern GPUs and ASICs can compute billions of SHA-256 hashes per second.
If a database leak occurs where user passwords were saved as standard SHA-256 hashes, attackers can easily crack billions of combinations using precomputed rainbow tables or brute-force dictionaries.
For password security, engineers must use Key Derivation Functions (KDFs) with deliberate computational cost and memory hardness:
- bcrypt: Utilizes a configurable work factor (cost) to adapt to escalating hardware speeds.
- Argon2: Winner of the Password Hashing Competition; resists GPU-based attacks by requiring dedicated memory buffers.
- Salt: A cryptographically random string appended to each password prior to hashing, neutralizing rainbow table attacks.
4. Generate and Verify Hashes Locally
Generate cryptographic checksums securely in your browser using the Web Cryptography API:
- Compute SHA-256 hashes in seconds: SHA-256 Hash Generator
- Create multi-algorithm checksums: General Hash Generator
- Evaluate password resilience: Password Strength Checker