Study Guide
Hashing and Integrity Checking
What a cryptographic hash is and why it is not encryption: fixed-length digests, the SHA families, preimage and collision resistance, why collisions must exist, why MD5 and SHA-1 are no longer suitable, and what checking a download's checksum does and does not prove.
Lesson 6.3 Cryptography & PKI
Encryption keeps data secret from people without the key. This lesson starts from a different practical problem: how can you be sure that a file is exactly the one you were meant to get?
Stage: Think
Is it the same file?
A colleague sends you a 2 GB video of a school concert to put on the school website. It takes an hour to arrive. Before publishing it, you want to be sure your copy is exactly the one they sent: not cut short, and not altered.
Think it through
Sending the whole file back to compare would take another hour, but you can phone your colleague. What could the two of you compare that is much shorter than the file?
- Hint 1: Could you each work something out from the file, and read it aloud?
- Hint 2: What would it need to be like for a one-letter change to show up?
Show what happens
You could each run the file through the same procedure that produces a short code, and read the codes to each other. If the codes match, the files match. But only if the code has the right properties.
Think it through
- Hint 1: Think about what could go wrong if two different files gave the same code.
Show the answer
Answer: A. Any change to the file, however small, must change the code.
Any change must change the code, and the same file must always give the same code. The code should be short, and the same length for any file. It needs no secret: anyone can work it out. A procedure like this exists, and the next step names it.
Stage: Explain
The idea
A cryptographic hash function takes input of any size and produces a short, fixed-length value called a digest.
The digest is often called a hash, a hash value or, for a file, a checksum. A useful comparison is a fingerprint. A fingerprint is small, it identifies one person in practice, and you cannot rebuild the person from it.
Stage: Experiment
Try it: two digests
Think it through
Show the answer
Answer: B. Most of it, unpredictably, even though the change was tiny.
A one-character change alters roughly half of the digest’s bits. Edit either message in the panel and watch it happen.
Edit either message. Each digest is always 64 hexadecimal characters, whatever the length of the message, and a one-character change alters roughly half of the digest’s bits.
SHA-256 digest 4f5eb1fd8247824c42dc6d1ff80779ea990e8ace66e52cf29e365d7cf3d7c83c
Length 12 characters in, 64 hexadecimal characters (256 bits) out
SHA-256 digest e5beb5abc9dde91bed8684febe53990ca516d01f1a048f2e72fb4bca650b7a18
Length 12 characters in, 64 hexadecimal characters (256 bits) out
61 of the 64 digest characters differ between the two messages.
The digests are computed in your browser. Nothing you type is sent anywhere.
The panel shows the properties that make the phone-call check work. A good hash function has these properties.
- Fixed length. A three-word message and a three-gigabyte video produce digests of the same length.
- Deterministic. The same input always gives the same digest, on any computer.
- One-way. There is no practical way to get from the digest back to the input.
- Sensitive. Changing one character of the input changes the digest completely and unpredictably.
- No key. Anyone can compute the digest of anything.
Integrity is one of the three objectives of the CIA triad. A hash gives a cheap, exact test of it: compute the digest of the data now, compare it with the digest computed before, and if they differ, the data has changed. Hashes are also the foundation of digital signatures, password storage and blockchains, each of which has its own lesson in this module.
Stage: Explain
A hash is not encryption
Think it through
Show the answer
Answer: B. No: almost all the information is gone.
64 characters cannot hold 2 GB. Almost all of the information has been thrown away, so there is nothing to turn back into the file. That is the difference from encryption.
A digest is sometimes described as “encrypted” data. It is not, and the difference matters.
- Encryption is reversible with the key. Its purpose is confidentiality.
- Hashing is not reversible by anyone. There is no key and nothing to decrypt. Its purpose is to detect change.
Check your understanding
Show the answer
Answer: C. There is no key: nobody can turn a digest back into the file.
Hashing has no key and cannot be reversed: a digest is far too small to contain the original data.
A digest cannot contain the original data. A 3 GB file and its 256-bit digest are not the same information in a different form; almost all of the information has been thrown away.
Do not confuse: Encoding, encryption and hashing
- Reversible?Encoding
- Yes, by anyone. No key. Changes how data is represented.Base64.
- Reversible?Encryption
- Yes, but only with the key. Keeps data confidential.AES.
- Reversible?Hashing
- No, by nobody. No key. Produces a fixed-length digest for detecting change.SHA-256.
Stage: Explain
The SHA families
SHA stands for Secure Hash Algorithm. The SHA algorithms are published by NIST, and they come in families.
| Family | Members | Digest length | Position today |
|---|---|---|---|
| SHA-1 | SHA-1 | 160 bits | Broken for collisions. Being withdrawn. |
| SHA-2 | SHA-224, SHA-256, SHA-384, SHA-512 | 224 to 512 bits | In wide current use. |
| SHA-3 | SHA3-256, SHA3-512 and others | 224 to 512 bits | A newer, differently designed alternative. |
The number in SHA-256 and SHA-512 is the digest length in bits. Both belong to the SHA-2 family. SHA-256 is the most widely used hash function today. A SHA-256 digest is usually written as 64 hexadecimal characters, because each hexadecimal character represents four bits.
MD5 is an older hash function, not part of the SHA families, with a 128-bit digest.
Stage: Explain
What makes a hash secure
A hash function is only useful for security if certain things are infeasible, that is, not achievable with any realistic amount of computing.
Preimage resistance
Given a digest, it should be infeasible to find any input that produces it.
This is preimage resistance, the “one-way” property. Without it, a stored digest would reveal what was hashed.
Collision resistance
Think it through
Show the answer
Answer: A. That you approved the unfair one too.
Anything said about one digest applies to every input with that digest. That is why it must be infeasible to find two such inputs.
It should be infeasible to find two different inputs that produce the same digest.
Two such inputs are called a collision. Collision resistance matters whenever a digest stands in for a document: if an attacker can prepare two different documents with one digest, anything said about the first document’s digest, including a signature on it, applies equally to the second.
Go deeper A third property: second-preimage resistance
There is a property between the two. Second-preimage resistance means that, given one particular input, it is infeasible to find a different input with the same digest.
The difference from collision resistance is who chooses. In a collision attack the attacker is free to choose both inputs, which is much easier. In a second-preimage attack one input is fixed in advance, for example a genuine software installer that the attacker wants to replace with a malicious one of the same digest.
MD5’s collision resistance is broken. Its second-preimage resistance has not been broken in practice, which is why swapping a genuine file for a malicious one with the same MD5 digest is still not a practical attack. It is no reason to keep using MD5.
Stage: Discover
Collisions must exist
Think it through
Show the answer
Answer: B. Yes: there are more possible inputs than digests, so some must share.
There are infinitely many possible inputs and only 2256 digests, so some inputs must share one. Security does not mean “no collisions”; it means nobody can find one.
Here is a fact that surprises many people: every hash function has collisions.
The reasoning is simple counting. A SHA-256 digest is 256 bits long, so there are 2256 possible digests. That is an enormous number, but it is finite. The number of possible inputs is unlimited, because an input can be any length. More inputs than digests means that some inputs must share a digest.
So “secure” does not mean “has no collisions”. It means nobody can find one. For SHA-256, no collision has ever been found.
The birthday effect
How hard should finding a collision be? Less hard than intuition suggests, because of an effect named after a party puzzle.
Think it through
Show the answer
Answer: A. About 23.
The answer is 23, because any pair will do and 23 people form 253 pairs. The same effect makes collisions much easier to find than preimages.
Most people guess about 180, half of 365. The answer is 23. The reason is that nobody is looking for a match with one particular person. Any pair will do, and 23 people form 253 different pairs.
Hashes behave the same way. To find an input matching one chosen digest (a preimage) of an n-bit hash takes about 2n attempts. To find any two inputs that match each other (a collision) takes only about 2n/2. This limit is called the birthday bound, and an attack that searches for any matching pair in this way is called a birthday attack.
| Hash | Digest length | Work to find a collision, at best |
|---|---|---|
| MD5 | 128 bits | About 264, and in practice far less because of design flaws |
| SHA-1 | 160 bits | About 280, and in practice far less because of design flaws |
| SHA-256 | 256 bits | About 2128 |
This is why digests need to be twice as long as you might expect: a 256-bit digest gives 128 bits of protection against collisions.
Stage: Explain
Why MD5 and SHA-1 are no longer suitable
Both algorithms have weaknesses in their design that let collisions be found far faster than the birthday bound allows.
- MD5. Collisions were demonstrated in 2004 and can now be produced in seconds on an ordinary computer. Researchers have used MD5 collisions to forge a certificate that browsers accepted.
- SHA-1. A practical collision was published in 2017 by researchers at Google and CWI Amsterdam, who produced two different PDF files with the same SHA-1 digest. NIST has announced that SHA-1 should be phased out completely by the end of 2030.
The accurate statement is this: MD5 and SHA-1 are not suitable where collision resistance matters, which includes digital signatures and certificates. They should not be chosen for anything new.
Check your understanding
Show the answer
Answer: C. Disagree: easy MD5 collisions let one signature cover two documents.
MD5 collisions can be produced in seconds, so a signature on one document could be claimed for another with the same digest. A collision-resistant hash such as SHA-256 is needed.
You will still meet MD5 digests as simple checks for accidental corruption, for example in older download pages. That use is not a security control: it detects a damaged file, not a deliberately substituted one.
Stage: Experiment
Checksums and verifying a download
A checksum is a digest published alongside a file so that anyone can check their copy. Software publishers, including the distributors of operating system images, publish SHA-256 checksums for their downloads.
Think it through
Show the answer
Answer: B. Your copy matches the file the page describes, and nothing more.
A match shows that your copy is identical to the file the checksum describes. It does not show who published either, which is why careful publishers sign their checksum files. The steps and the example below end at the same point.
- Download the file.
- Compute its digest with a tool on your own computer. On Windows,
Get-FileHashin PowerShell computes SHA-256 by default; on Linux,sha256sumdoes. - Find the publisher’s checksum on the publisher’s official site.
- Compare the two, character by character. If they are identical, your copy is the same as the file the checksum describes. If they differ at all, do not use the file.
Mr Lowe looks after a school’s computers. He needs to install a seating-plan program, ClassView 4.2, on forty staff laptops. The program and its publisher are invented; the two digests shown are real SHA-256 values of two short pieces of text that differ by one full stop.
-
He downloads the installer from the publisher’s website.
-
He finds the published checksum on the publisher’s download page:
807d69098f736fe6748f7ed124060e6e2f83862021b94596a97b57a0e560ad68 -
He computes the digest of his copy with
Get-FileHash, and gets:0bdbf8b1d50745e951e83bb0a07fcfa8d28595de39805772d576c1875f544978 -
He compares them. They differ from the very first character:
80…against0b…. He does not need to read to the end. -
He does not install it. His copy is not the file the publisher described. He cannot tell from the digests why: the download may have been cut short, or the file may have been altered. Either way the answer is the same.
-
He downloads it again over the school’s wired connection and computes the digest once more. This time he gets
807d6909…e560ad68, and checks the whole of it against the published value. Every character matches. -
The result. The second copy is identical to the file the publisher published, and he installs that one.
Why the two digests look nothing alike. The two files differed by a tiny amount, and the digests share almost no characters. That is the avalanche effect seen in the SHA-256 panel, and it is what makes the check quick: a wrong file does not produce a digest that is nearly right.
What the match did not tell him. It showed that his copy matches the page. It did not show that the page is honest, which is the limit described next.
What a match tells you, and what it does not:
- It tells you that the file was not damaged in transit and matches the published value.
- It does not tell you who produced the file. A checksum has no key and no identity attached. Anyone can compute one.
- It is only as trustworthy as its source. If an attacker can replace the file on a download page, they can replace the checksum printed next to it. A match then proves nothing.
For that reason, careful publishers go one step further: they publish the checksums in a file and digitally sign that file. Checking the signature shows that the checksum list really came from the publisher; checking the checksum then shows that the download matches the list. Digital Signatures explains how a signature adds the identity that a bare checksum lacks.
Stage: Explain
Where hashes are used
- Integrity checking: detecting changes to files, backups, logs and evidence.
- Digital signatures: a signature is made over the digest of a document, not the whole document.
- Password storage: systems store a digest of each password instead of the password. An ordinary fast hash is not enough for this, and precomputed “rainbow tables” are one reason why. Password Storage: Salting, Stretching and Peppering covers it.
- Blockchains: each block stores the digest of the block before it. See Blockchain and Hash-Linked Records.
Stage: Explain
Security+ terminology
The CompTIA Security+ SY0-701 exam objectives list Hashing under objective 1.4, and list hashing again in objective 3.3 among the methods to secure data. Objective 2.4 lists collision and birthday among cryptographic attacks.
Stage: Apply
Apply it in a new situation
These questions use the lesson in situations it has not shown. For the strongest test of your understanding, come back to them on another day and answer each one at the first attempt.
Apply it
- Hint 1: What does a digest change in response to?
Apply it
- Hint 1: Look at the password point in “Where hashes are used”.
Show the answer
Answer: B. Partly: digests are not encryption, and fast hashes alone are not enough.
A digest is not encryption, and an ordinary fast hash is not enough for passwords: attackers can hash huge numbers of guesses. Password storage uses salted, deliberately slow hashing, covered in its own lesson.
Stage: Check
Check your understanding
These questions come from the approved revision bank. They were approved under owner-authorised delegated review: the site owner authorised the review and did not read each question individually.
Show answer
Answer: False
False. A cryptographic hash function is one-way and uses no key, so there is nothing to decrypt: a hash is not encrypted data. A digest has a fixed length whatever the size of the input, so it cannot contain the original data.
Revision sources: Hashing and Integrity Checking (Supplementary Study Guide explanation)
Show answer
Answer: Both are 256 bits long
A hash function turns input of any size into a digest of fixed length, which for SHA-256 is 256 bits, so the small text file and the large video both produce 256-bit digests. The digest does not grow with the input and is not a compressed copy of it, and a hash function uses no key.
Revision sources: Session 9: Cryptographic Algorithms, Public Key Infrastructure and Cryptographic Solutions (Classroom session record) · Hashing and Integrity Checking (Supplementary Study Guide explanation)
Show answer
Answer: It differs completely and unpredictably from the old one
A small change to the input produces a completely different digest. That is what makes a digest useful for detecting change: a one-character edit cannot hide behind a nearly identical digest. The digest’s length is fixed at 256 bits, so it neither grows nor depends on the document’s length.
Revision sources: Hashing and Integrity Checking (Supplementary Study Guide explanation)
Show answer
Answer: Preimage: a digest cannot be turned back into an input. Collision: two inputs with one digest cannot be found.
Preimage resistance means a digest cannot feasibly be turned back into an input that produces it, and collision resistance means two different inputs with the same digest cannot feasibly be found. Fixed length, sensitivity to change and the absence of a key are other features of hash functions, not these two properties.
Revision sources: Session 9: Cryptographic Algorithms, Public Key Infrastructure and Cryptographic Solutions (Classroom session record) · Hashing and Integrity Checking (Supplementary Study Guide explanation)
Show answer
Answer: True
True. Collisions must exist because inputs outnumber digests: there are unlimited possible inputs and only a fixed number of possible digests. What a secure hash provides is that finding such a pair is infeasible, not that no pair exists.
Revision sources: Hashing and Integrity Checking (Supplementary Study Guide explanation)
Show answer
Answer: A matching pair of any kind counts, so roughly 2 to the power n/2 attempts suffice
Because of the birthday effect, finding some collision takes roughly 2 to the power n/2 attempts for an n-bit digest: the attacker is not aiming at one target, and every new attempt is compared with all the earlier ones. Collisions are not looked up in tables, no part of a digest is fixed in advance, and a hash uses no key.
Revision sources: Session 9: Cryptographic Algorithms, Public Key Infrastructure and Cryptographic Solutions (Classroom session record) · Hashing and Integrity Checking (Supplementary Study Guide explanation)
Show answer
Answer: Practical MD5 collisions exist, so two different documents can share a digest
Practical collisions have been produced for MD5, which makes it unsuitable where collision resistance matters: someone could prepare two documents with one digest and swap them. MD5 uses no key, its weakness is collisions and not the reversal of a digest, and every MD5 digest has the same fixed length of 128 bits.
Revision sources: Session 9: Cryptographic Algorithms, Public Key Infrastructure and Cryptographic Solutions (Classroom session record) · Hashing and Integrity Checking (Supplementary Study Guide explanation)
Show answer
Answer: A collision attack: two different inputs share one digest
A collision is two different inputs with the same digest, and practical collisions have been produced for MD5, which makes it unsuitable where collision resistance matters. The attacker chose both versions, so nothing had to be matched to a digest fixed in advance, which is what a preimage would need. A digest is one-way and uses no key, so it cannot be decrypted, and no published value was replaced.
Revision sources: Session 9: Cryptographic Algorithms, Public Key Infrastructure and Cryptographic Solutions (Classroom session record) · Hashing and Integrity Checking (Supplementary Study Guide explanation)
Show answer
Answer: SHA-1 is unsuitable where collision resistance matters; SHA-256 and SHA-512 are members of the SHA-2 family
SHA-256 and SHA-512 belong to the SHA-2 family in current use, and practical collisions have been produced for both MD5 and SHA-1, which makes them unsuitable where collision resistance matters, as it does for signatures. No digest can be decrypted: a hash function is one-way and uses no key.
Revision sources: Session 9: Cryptographic Algorithms, Public Key Infrastructure and Cryptographic Solutions (Classroom session record) · Hashing and Integrity Checking (Supplementary Study Guide explanation)
Show answer
Answer: The file matches what that page describes, but not who produced it
A matching checksum detects change only if the published value comes from a source the attacker could not also change, and a checksum alone says nothing about who produced the file. Someone able to replace the file on that page could replace the checksum beside it. A digest provides no confidentiality and says nothing about how the file travelled.
Revision sources: Session 9: Cryptographic Algorithms, Public Key Infrastructure and Cryptographic Solutions (Classroom session record) · Hashing and Integrity Checking (Supplementary Study Guide explanation)
Study and revision
Practise through the Cryptography & Data Protection topic. Questions cover why a hash is not encryption, fixed-length digests, sensitivity to change, preimage and collision resistance, why collisions exist, the birthday effect, MD5 and SHA-1, recognising a collision attack, and what a checksum establishes; six flashcards recall the definitions. Most are learning-only. The questions that have been verified against CompTIA Security+ SY0-701 objectives 1.4 and 2.4 are also in the Security+ practice track; that does not mean the lesson covers the whole of an objective, and the lesson does not establish practical experience.
Stage: Consolidate
What to remember
- A hash turns any input into a short, fixed-length digest that cannot be turned back into the input.
- Hashing is not encryption: there is no key and nothing to decrypt.
- Every hash has collisions; a secure hash is one where nobody can find them.
- MD5 and SHA-1 are unsuitable wherever collision resistance matters.
- A matching checksum shows your copy matches the published value, not who published it.
Key terms
- Hash function
A function that turns input of any size into a fixed-length digest. It is one-way and uses no key.
- Message digest
The fixed-length output of a hash function: a short fingerprint of the input.
- Hash collision
Two different inputs that produce the same digest.
- Checksum
A digest published or stored alongside data, so that a copy can be checked against it.
Common misunderstandings
A hash is one-way and has no key. It cannot be decrypted, because the original data is not in it.
Every hash has collisions, because inputs outnumber digests. A secure hash is one where nobody can find them.
A match shows that the file matches the published value. It says nothing about who published it, or about what the file does.
MD5 collisions can be made in seconds. It is unsuitable wherever someone might deliberately create two inputs with one digest.
Further reading
- NIST: Hash functions: the approved hash algorithms and their status.
- NIST retires SHA-1 cryptographic algorithm: the 2022 announcement and the 2030 date.
- SHAttered: the 2017 SHA-1 collision, from the researchers who produced it.
- Kali Linux: Download Kali Linux images securely: a publisher’s own instructions for checking a signed checksum file and then the download.
- CompTIA Security+ SY0-701 exam objectives (PDF): objectives 1.4, 2.4 and 3.3.
Lesson sources and acknowledgements
Sources and scope
- Covered in Session 9 (see the Session 9 Learning Log): the SHA families, SHA-256 and SHA-512, fixed-length digests and weaknesses in MD5 and SHA-1; preimage and collision resistance, hash collisions and the birthday bound; and checksums and integrity verification. The checksums published for Kali Linux downloads were among the tutor’s demonstrations; what was shown is not recorded.
- Accuracy qualifications: a hash is one-way and is not encrypted data; hash collisions are possible for every hash function; MD5 is not suitable for collision-sensitive security use; a checksum shows that a file matches a published value and not who produced it.
- Independently checked: the SHA families against NIST FIPS 180-4 and FIPS 202; the status of SHA-1 against NIST’s 2022 announcement; the SHA-1 collision against the researchers’ own publication; and the Security+ wording against the published SY0-701 objectives. These are external references, not course evidence.
- Supplementary explanation: every definition, the fingerprint comparison, the list of properties, the interactive digest panel, the three-way comparison, the family table, second-preimage resistance, the counting argument, the birthday puzzle and table, the dates and details for MD5 and SHA-1, the download steps and their limits, the fictional worked check of an installer (the program, publisher and school are invented; the two digests are genuine SHA-256 values of two short example texts, not of any real file), the list of uses and the misunderstandings. These were developed afterwards and are my explanations, not the tutor’s words. The diagram is original.
- Guided version (published 1 November 2026, awaiting the site owner’s editorial review): the concert-video opening questions, every question asked in the lesson with its feedback and hints, the two-contract, signing, evidence and password examples and the closing summary are supplementary explanation written for the Study Guide. The settings are fictional. The questions in the lesson’s steps are not revision-bank items; those in “Check your understanding” are, unchanged.
- No practical work is claimed. The two payment messages in the digest panel are fictional. The steps for checking a download describe the general procedure. I do not record having verified a download as part of this lesson.
A fixed, step-by-step method for carrying out a task. In cryptography, the published method that a cipher or a hash function follows.
The limit on collision resistance: a collision in an n-bit hash can be found in about 2 to the power n/2 attempts, far fewer than the 2 to the power n needed to match one chosen digest.
A ledger made of blocks of records in which each block includes the hash of the block before it.
A digest published or stored alongside data, so that a copy can be checked against it.
The property that it is infeasible to find two different inputs that produce the same digest.
The security objective of restricting information to authorised people, systems or processes.
A measure intended to modify risk, for example by restricting access, detecting misuse or supporting recovery.
A document, signed by a certificate authority, that binds a public key to the identity of its subject. The standard format is X.509.
A value produced with a private key that only the signer should hold, which anyone can check with the matching public key to confirm who signed some content and that it has not changed since.
Transforming data with a cipher and a key so that it cannot be read without the right key. Decryption reverses it.
Two different inputs that produce the same digest.
A function that turns input of any size into a fixed-length digest. It is one-way and uses no key.
A base-16 number system using the digits 0–9 and the letters A–F, where A = 10 and F = 15. One hexadecimal digit represents exactly four bits.
The security objective of keeping information accurate and complete by protecting it from unauthorised or improper modification.
An older hash function with a 128-bit digest. Collisions for it can be produced in seconds.
The fixed-length output of a hash function: a short fingerprint of the input.
The software that runs a computer and lets other programs use it. Windows, macOS, Linux, Android and iOS are operating systems.
The property that, given a digest, it is infeasible to find any input that produces it.
Step-by-step instructions explaining how a particular task should be carried out.
A precomputed table for reversing unsalted hashes of likely passwords.
A group of hash-function families published by NIST. SHA-256 and SHA-512 belong to the SHA-2 family in current use.
Your progress on this lesson
Saved in this browser only. It is not sent anywhere, does not follow you to another device, and is lost if you clear this site’s data.
This browser is not allowing the site to save progress, so it will be forgotten when you leave the page.