Kevin Jones Senior .Net Developer Thycotic Software Ltd.
Hashing is a cryptographic function that takes a set of data as input and produces a “thumbprint” of this data, which is called a digest. This thumbprint cannot be reversed back into its original form, making hashing ideal for storing passwords to ensure they cannot be stolen.
When hashing data, its output is determined by the algorithm, or mathematical formula used to produce the hash. The most common hashing algorithm is Secure Hash Algorithm version 1, commonly known as SHA-1. SHA-1 produces a 160 bit digest. Regardless of how much data it uses as input, its digest size is consistently 160-bits.
A hash algorithm has many requirements, the first being that it produces a digest that is unique to the best of its ability. The second is where similar inputs do not produce and output result that is similar, commonly called the cascade effect. The cascade effect is defined as a single change to the input will result in a completely different hash. For example i, if we had the input:
As this example demonstrates, two inputs that are similar produce outputs that are not similar in any place.
What are the risks of hashing?
As will all hashing algorithms, hashing is all based on mathematical improbability. Since the input of a hash is unlimited in length and combinations, but the output is a fixed size, at some point two unique inputs will produce identical outputs. This is called a hash collision. SHA-1 is known to have hash collisions when you exceed 263 calculations.
Addressing SHA-1’s Limitations
The limitations and security issues related to SHA-1 have been addressed by a new set of hashing algorithms called SHA-2. SHA-2 includes hashing algorithms that have larger digests, ranging from 224-bits to 512-bits. Collisions have not yet been produced using any of the SHA-2 algorithms. The strongest of the SHA-2 algorithms is SHA-512. This produces a 512-bit digest which is roughly three times larger than that of SHA-1. SHA-512’s improvements go beyond producing a larger digest. Its algorithm uses more complex operations compared to SHA-1, making the algorithm by itself stronger. Using the previous two examples, these are the results using the SHA-512 algorithm ii:
The Microsoft .NET Framework includes all of the necessary classes to hash data. All of the hash algorithms can be found in the System.Security.Cryptography namespace. The class SHA512Managed is the class used to produce a 512 bit digest. Here is a snippet that will hash an input string and return a hexadecimal string:
C#:
VB.NET:
Both of which result in the following output if the input is “hello”:
Secret Server uses SHA-512 because Secret Server is designed to be as secure as possible. SHA-512 is the government standard for hashing, and to better protect data and to reduce all chances of Secret Server being compromised.
i This example assumes SHA-1 and Unicode encoded text.
ii This example uses the SHA-512 algorithm and Unicode encoded text.
