Chapter 33 of 41

Encryption & Hashing

On this page

Whenever we talk about cybersecurity, two terms appear again and again: Encryption and Hashing.

They may look similar because both involve mathematical transformations of data, but they solve different problems.

The easiest way to remember the difference is:

Encryption → Protects data so it can be recovered later.

Hashing → Creates a fixed-size fingerprint of data.

Let's understand both with simple examples.

What Is Encryption?

Encryption is the process of converting readable data (plaintext) into an unreadable form (ciphertext) using a cryptographic algorithm and a key.

The purpose is mainly to provide confidentiality.

For example:

Plaintext
"Hello John"
     ↓
  Encryption
     ↓
Ciphertext
"8fK#2xP..."

Someone who intercepts the ciphertext should not be able to understand the original message without the required key.

To recover the original data:

Ciphertext
     ↓
  Decryption
     ↓
Plaintext
"Hello John"

How Does Encryption Work?

A simplified encryption process looks like this:

        Secret Key
            ↓
Plaintext → Encryption → Ciphertext
                         ↓
                    Decryption
                         ↓
                      Plaintext

Modern encryption algorithms are designed so that knowing the algorithm and ciphertext does not make it practical to recover the plaintext without the appropriate key.

Types of Encryption

There are two major categories.

Symmetric Encryption

Symmetric encryption uses the same secret key for encryption and decryption.

          Same Key
             ↓
Data → Encrypt → Ciphertext
                  ↓
             Decrypt
                  ↓
                Data

Common algorithms include:

AES
ChaCha20

Symmetric encryption is generally fast and is commonly used to protect large amounts of data.

Example

Imagine Alice and Bob have securely shared a secret key.

Alice encrypts:

"Meet at 5 PM"

Bob uses the same secret key to decrypt it.

The difficult part is securely getting the shared key to both parties.

Asymmetric Encryption

Asymmetric cryptography uses a pair of keys:

Public key
Private key

The public key can be shared, while the private key must be protected.

A simplified encryption example:

Message
   ↓
Encrypt with Public Key
   ↓
Ciphertext
   ↓
Decrypt with Private Key
   ↓
Message

Asymmetric cryptography is generally slower than symmetric encryption, so modern secure systems typically use it for tasks such as authentication and key establishment, while symmetric encryption protects the actual bulk data.

Examples of public-key algorithms include:

RSA
ECC-based systems

What Is Hashing?

Hashing is the process of converting input data into a fixed-size value called a hash or digest using a hash function.

For example:

Input:
Hello

   ↓ Hash Function

Hash:
[Fixed-size digest]

If even a small part of the input changes, a cryptographic hash function is designed to produce a substantially different digest.

"Hello"
   ↓
Hash A

"hello"
   ↓
Hash B

The two hashes will be different.

Important Properties of Cryptographic Hashing

A good cryptographic hash function is designed to have properties such as:

One-Way

It should be computationally infeasible to recover the original input from its hash alone.

Fixed-Length Output

Inputs of different sizes produce digests of the algorithm's fixed output size.

Avalanche Effect

A small change in the input should produce a substantially different output.

Collision Resistance

It should be computationally difficult to find two different inputs that produce the same hash.

Common cryptographic hash functions include:

SHA-256
SHA-3

Hashing vs Encryption

This is the most important part.

Encryption	Hashing
Mainly provides confidentiality	Commonly used for integrity and data fingerprinting
Reversible with the correct key	Not designed to be reversed
Uses a cryptographic key	Hash functions do not use a secret key in the ordinary sense
Produces ciphertext	Produces a digest
Original data can be recovered	Original data is not meant to be recovered from the digest
Example: AES	Example: SHA-256

Think of it like this:

Encryption:
Data → Encrypt → Ciphertext → Decrypt → Data

Hashing:
Data → Hash → Digest

Hashing Passwords

Hashing is commonly discussed in relation to password storage, but simply applying a fast hash such as SHA-256 to passwords is not considered sufficient password protection.

Passwords should normally be processed using a password-hashing or password-based key-derivation function designed to be expensive and resistant to large-scale guessing attacks.

Common choices include:

Argon2
scrypt
bcrypt
PBKDF2

A simplified password-storage process is:

User Password
      ↓
Password Hashing Function
      ↓
Stored Password Hash

When the user logs in again, the entered password is processed using the same scheme and the result is checked against the stored value.

A salt is also normally used so that identical passwords do not result in identical stored hashes.

Encryption in HTTPS

Encryption plays a major role in HTTPS.

When you visit a website using HTTPS:

Browser
   ↓
TLS Handshake
   ↓
Secure Keys Established
   ↓
Symmetric Encryption
   ↓
Protected HTTP Communication

Modern TLS generally uses public-key cryptography for authentication and key establishment, then efficient symmetric cryptography to protect the actual application data.

Hashing in Network Security

Hash functions are useful in many security systems.

They can help with:

Data integrity
Digital signatures
Password protection when used as part of a suitable password-hashing scheme
File integrity verification
Message authentication constructions

For example, suppose you download a file.

Original File
     ↓
Hash
     ↓
SHA-256 Digest

If the file changes, its hash should also change.

File A → Hash A

Modified File → Hash B

Comparing hashes can therefore help detect unexpected changes, assuming the reference hash itself is trusted.

Encryption vs Hashing: Real-Life Analogy

Think about sending a valuable letter.

Encryption

You put the letter inside a locked box.

Only someone with the correct key can open it.

Message → Locked Box → Message

This represents encryption.

Hashing

You create a unique fingerprint of the letter.

You don't use the fingerprint to reconstruct the letter. Instead, you can use it to check whether the letter has changed.

Message → Fingerprint

This represents hashing.

Can a Hash Be Decrypted?

No.

A cryptographic hash is not designed to be decrypted.

For example:

Data
 ↓
SHA-256
 ↓
Hash

There is no normal "decrypt" operation that turns the hash back into the original data.

However, if the original input comes from a small or predictable set, an attacker may be able to guess inputs and hash them until one matches. This is why password storage requires specialized password-hashing algorithms and strong password practices.