If crc or CRC32 is specially designed to catch errors, then what's the point of SHA or md4-5 or any other hashing function? What I did was, I had a 190 mb png file (rendered in 16k resolution with blender lol) and I took its sha256 and CRC32 hash, then I did the same, only changing 1 bit of the image. Just 1 bit. And I got a different crc, but also a different sha256
190 mb ~ 1 520 000 000 bits,
So what's the point then, if they both detect such small errors?
So what's the point then, if they both detect such small errors?
What CRC* can't do and SHA* and some MD* can, is that the latter are usually strong enough to prevent any supercomputer from creating 2 different files with the hash digest, where as CRC* don't have such strength.
CRC* are good at detecting "wire noise" errors, but otherwise lacking certain strength required in cryptography.
(from comments) so if I understand correctly, the purpose of CRC is to let you KNOW that there's an error, and SHA* MD* etc. Are specifically designed to have different hashes?
Somewhat correct, CRC* can let you know "wire noise" errors, but not man-in-the-middle sabotage; SHA* and MD* are specifically designed to be "collision resistant", which means any "humanly-possibly" supercomputer cannot create 2 different files with the same hash digest.
A bit of background
CRC is invented by W. Wesley Peterson in 1961 according to Wikipedia. Hash function was (as I believe) first described (as one-way hash function) in "Security, Authentication, and Public Key Systems" by Ralph C. Merkle, in 1979
CRCs are OK to detect naturally-occurring errors. But in cryptography, we face intelligent adversaries, which can use the mathematical properties of CRCs in order to make an arbitrary alteration in a file without altering its CRC. This is easy, even for large CRCs.
Hashes are designed to prevent that (called a second-preimage attack), and other attacks such as making two different files with the same hash (called a collision attack).
If CRCs or cryptographic hashes are different, then their input is different. In a cryptographic context, if CRCs are equal, we can't tell if their input are equal or not; whereas if cryptographic hashes are equal, then their input must be equal (or the hash used is not a secure cryptographic hash).
Cyclic redundancy checks are for quickly checking data integrity, mainly for detecting accidental data corruption. CRCs are not meant to be attacked, not even by your little brother, they are easily reversible, and have one application. Think of the CRC as functioning along the lines of a hand-held calculator.
Cryptographic hashes can help protect national-level strategic intelligence against well-funded, highly efficient adversaries, and data like the world's most important financial transactions. Cryptographic hashes expect vigorous attack from the best attackers, and they have many, many, applications such as creating cryptographic primitives, which is serious business. Think of cryptographic hashes as workhorses for our modern, highly computerized cryptography.
Your question does make sense based on what you observed. But the point is that cryptographic hashes can do so much more than a CRC. A hand-held calculator from 1980 can multiply 25519 and 7.11. IBM's Summit supercomputer can do that too, at 200 petaflops a second, and get the same result. But that does not mean that the calculator and supercomputer have exactly the same abilities.
