Hash functions
A file’s footprint
Encryption protects secrecy. But how can we prove that a file has not been altered in transit? That is another question, and it requires a different tool.
The definition
A hash function transforms data of any size into a fixed-size fingerprint.
"Bonjour" → 2a1d5f... (64 characters)
un film de 4 Go → 9c8e01... (64 characters)
SHA-256 always produces 256 bits, regardless of the input.
The four expected properties
- Deterministic — the same input always produces the same fingerprint.
- Fast to compute.
- One-way — it is not possible to work backwards from the fingerprint to the input.
- Practical collision-resistant — it is not possible to find two different inputs with the same fingerprint.
The avalanche effect
Changing a single bit of the input must drastically alter the entire fingerprint:
"Bonjour" → 2a1d5f4e...
"Bonjoux" → f70b93c1...
No resemblance whatsoever. This is what makes it impossible to guess the input by trial and error: one never gets ‘closer’.
An important point
A hash is not an encryption. There is no key, and above all no inverse operation: the information is lost. A 4 GB film cannot fit into 256 bits.
Consequently, several inputs must share the same hash — these are collisions. They exist mathematically; the key point is that we do not know how to create them.
This is where MD5 and SHA-1 have failed: we now know how to produce collisions at will. They should be avoided. SHA-256 remains secure.