Hashes

📘Cisco Certified CyberOps Associate (200-201 CBROPS)

---

What is a Hash?

A hash is a digital fingerprint of data. It’s a unique fixed-length string generated from data using a hashing algorithm.

• No matter how big or small the data is, the hash will always have the same length.
• Hashes are one-way, meaning you cannot reverse them to get the original data.
• If even a single bit changes in the original data, the hash changes completely.

Example in IT:

• You download a software update. The website gives a hash value. After downloading, your system calculates the hash of the file. If the hash matches, you know the file was not tampered with.

---

Purpose of Hashes in Cybersecurity

Hashes are widely used in IT security for:

1. Data Integrity
   • Ensures that files or messages haven’t been altered.
   • Example: Verifying log files on a server or checking downloaded software integrity.
2. Password Storage
   • Systems store hashes of passwords instead of plaintext passwords.
   • Example: When a user logs in, the system hashes the entered password and compares it to the stored hash.
3. Digital Signatures
   • Hashes are used to create signatures that verify authenticity and integrity.
   • Example: A signed email can be verified by hashing the email content and comparing it to the signature hash.
4. File or Data Identification
   • Quickly compare files to see if they are identical.
   • Example: Malware databases store hashes of known malicious files. If a file matches a hash, it’s flagged as malware.

---

How Hashing Works (Simplified IT Example)

1. Take your file: example.txt
2. Run it through a hashing algorithm (like SHA-256)
3. Output: 9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08

If you change just one character in example.txt, the hash will completely change.

---

Common Hashing Algorithms

For the exam, you should know the popular hashing algorithms and their main characteristics:

Algorithm	Hash Length	Notes
MD5	128 bits (16 bytes)	Fast but not secure, vulnerable to collisions.
SHA-1	160 bits (20 bytes)	Stronger than MD5, but obsolete for secure systems.
SHA-256	256 bits (32 bytes)	Part of SHA-2 family, widely used and secure.
SHA-3	Variable, often 256 bits	Newer and secure, alternative to SHA-2.

Key Exam Tip:

• MD5 and SHA-1 are no longer considered safe for secure applications, but they are still used for basic file integrity checks.

---

Properties of a Good Hash

1. Deterministic: Same input always produces the same hash.
2. Fast: Can compute the hash quickly, even for large data.
3. Irreversible: Cannot reconstruct the original input from the hash.
4. Collision-Resistant: Hard to find two inputs producing the same hash.
5. Avalanche Effect: A tiny change in input drastically changes the hash.

---

Hash Uses in IT Environments

Here’s how hashes are applied in common IT scenarios:

1. System Logging
   • Hash log files to ensure no tampering.
   • Example: Security operations center (SOC) receives logs with hash values to verify authenticity.
2. Malware Detection
   • Antivirus stores hashes of known malware.
   • If a file on a system matches a malware hash, it’s flagged.
3. Data Transfer
   • When moving sensitive files between servers, hash the file before sending and after receiving to confirm it wasn’t corrupted or altered.
4. Password Authentication
   • Passwords stored as hashes in databases.
   • Example: When logging in, the system hashes the typed password and checks against stored hash.
5. Digital Certificates
   • Hashes ensure the certificate hasn’t been tampered with during transmission.
   • Example: SSL/TLS certificates use hashes for validation.

---

Hashing vs Encryption

It’s important to distinguish hashes from encryption:

Feature	Hash	Encryption
Purpose	Integrity check, ID	Confidentiality
Reversibility	One-way, irreversible	Two-way, reversible
Output Length	Fixed length	Variable, based on input

Remember: Hashing is not for hiding data—it’s for verifying it hasn’t changed.

---

Exam Tips

1. Know why hashes are used (integrity, authentication, identification).
2. Understand the difference between hashing and encryption.
3. Be able to recognize common algorithms and their strengths/weaknesses.
4. Understand one-way nature and collision resistance.
5. Be familiar with IT examples like password storage, log verification, and malware detection.

---

✅ Quick Memory Aid:

• Think of a hash as a digital fingerprint: unique, irreversible, and used to confirm identity and integrity of data.