13
$\begingroup$

As I understand it, a hashing algorithm is some kind of encryption, just a specific kind of it. So is it wrong to say "I encrypted this value." if I "only" hash it?

I understand that it gives the wrong impression, but I think it is not absolutely wrong, or is it?

$\endgroup$
  • 3
    $\begingroup$ Comments that are asserting that hashing is not encryption or vice versa will be removed. Please post a well explained answer instead if your point is not covered in the existing ones. $\endgroup$ – Maarten Bodewes Sep 10 at 13:00
51
$\begingroup$

Encryption algorithms and hash algorithms both belong to the realm of cryptography but are two different things: Encryption doesn't contain hash functions.

As stated on Wikipedia:

In cryptography, encryption is the process of encoding a message or information in such a way that only authorized parties can access it and those who are not authorized cannot.

An encryption algorithm turns some data into a ciphertext which can later be decrypted again to its original content by using the encryption key.

If you generate a hash of some data it can't be "reversed" back into its original content, because a hash function is (theoretically) a one-way function with loss of data.

$\endgroup$
  • $\begingroup$ Comments are not for extended discussion; this conversation - which is mainly about the word "theoretically" in the answer - has been moved to chat. $\endgroup$ – Maarten Bodewes Sep 11 at 10:48
  • 2
    $\begingroup$ A small note on terminology: historically cryptography was only about encryption / decryption. Cryptology was a more broad term, that also included analysis. Nowadays they are synonymous, and both are broadened to include secure hashing, random number generation, signature creation/verification etc. etc. etc. and the analysis thereof. Hence our site name :) $\endgroup$ – Maarten Bodewes Sep 11 at 13:08
20
$\begingroup$

Encryption implies that with the appropriate key, it is possible to decrypt and recover the original message. Which (in general) is not possible from a hash.

Thus “I will encrypt” is not adequate if one is going to hash.

While it is possible to construct hashes from encryption primitives (such as block ciphers), and vice versa, they are different beasts.

$\endgroup$
  • $\begingroup$ Why did you say 'in general'? $\endgroup$ – Begueradj Sep 11 at 10:29
  • 1
    $\begingroup$ @Begueradj Non cryptographic hashes may not be one way. Trying all possible inputs could lead you to find the correct input. $\endgroup$ – Maarten Bodewes Sep 11 at 12:20
13
$\begingroup$

I understand that it gives the wrong impression, but I think it is not absolutely wrong, or is it?

It is actually. A hash algorithm computes a 'fingerprint' if you will of the input. So just as a fingerprint identifies you, a hash identifies the input document.

But just as an entire human being cannot be recreated from just a fingerprint, so the original document cannot be (easily) recreated from the hash. This is the fundamental distinction with an encryption. In encryption it's useful to decrypt, using the original encryption key. You can't with a hash, and it has no key.

$\endgroup$
  • 2
    $\begingroup$ so the original document cannot be (easily) recreated from the hash – For most messages, it's fundamentally impossible. $\endgroup$ – forest Sep 10 at 6:31
  • 2
    $\begingroup$ @forest: ...because of the pigeonhole problem. Finding a preimage is theoretically possible, but there's no way to tell which was the original preimage - multiple "original documents" can hash to the same value. See e.g. natmchugh.blogspot.com/2014/10/… - from the output hash, it is impossible to tell which input was used. $\endgroup$ – Piskvor Sep 10 at 11:06
  • 2
    $\begingroup$ @Piskvor That's exactly the point I wanted to make. $\endgroup$ – forest Sep 10 at 11:08
2
$\begingroup$

I agree with other answers, but would like to add this: when talking to someone familiar with cryptography or fields using it (e.g. programming), you should indeed use the right vocabulary. But if you try to summarize what you are doing to a client, I would use neither and say something like "we store our password in a secure way" and eventually provide details somewhere else.

$\endgroup$
  • 1
    $\begingroup$ That might give a wrong impression of what is actually done. There is a substantial difference between storing a password and not storing a password (just the hash), which must be understood even by non-technical people. Any system that stores passwords brings potential security risk, and if you are a customer looking for developers, you must know the difference (or you will be left with a risky system made by developers who know nothing about hashing). $\endgroup$ – IllidanS4 Sep 10 at 11:17
  • 1
    $\begingroup$ Agreed, it may be not very well phrased, but the point would be: know what you do, and make it clear for others without the need to be too specific. If the explanation is for a final customer, I don't believe he needs to know what a hash is. $\endgroup$ – Lou_is Sep 10 at 11:24
  • $\begingroup$ I would argue that this is not an answer within the scope of crypto.se. We do not really deal with customer relations here. $\endgroup$ – Maeher Sep 10 at 18:07
  • 3
    $\begingroup$ @Lou_is: I think that most customers are OK with a little bit of jargon, as long as the meaning is clear enough. Something like "We only store secure hashes of passwords, so even if someone managed to steal the entire database, they still wouldn't have the passwords" should be fine. $\endgroup$ – ruakh Sep 11 at 0:18
1
$\begingroup$

I'm assuming this is something the user will get to see later? If that's the case I'd recommend just writing "hash" with a short explanation of what that means.

Something like:

Hash means that whatever it's used for is uniquely identifiable, but not reconstructible.

Even though in rare cases hashes overlap and therefore aren't 100% unique, if you're target audience isn't tech savvy - I'd just leave that out because it would add unnecessary complexity to the statement.

$\endgroup$
1
$\begingroup$

You will hurt yourself if you claim it is encryption, because (especially for password hashing) if a review is done password encryption (I.e. reversible encryption) should be flagged as a policy violation. So it is better to never use a incorrect term (in this assumed context). Otherwise you will have to do some back and forth to explain the actual method used.

Of course if you are not in a enterprise setting this might not apply to you (but there is still nothing gained from using the wrong terms)

$\endgroup$
-1
$\begingroup$

Typically we require encryption be reversible, so it can be used as a communication system.

Mathematically, when we talk about a cryptographic system, we are focusing on invertible functions. This change in viewpoint is important, because it opens up the possibilities for how we can encrypt information.

For example, we can use a linear function (affine transformation) as an encryption system:

https://youtu.be/1S92scw5zIg?list=PLKXdxQAT3tCssgaWOy5vKXAR4WTPpRVYK

$\endgroup$
  • 1
    $\begingroup$ Welcome to crypto.stackexchange - Can you please summarize the content of the link, or mention what the content is/why it's relevant? If the link ever dies or changes, it greatly diminishes the utility of the answer. $\endgroup$ – Ella Rose Sep 9 at 17:01
  • 3
    $\begingroup$ There's not a single word "hash" in this answer. $\endgroup$ – Oleg V. Volkov Sep 10 at 1:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.