First some definitions;
Pre-image resistant: given a hash value $h$ find $m$ such that $h=Hash(m)$. Consider storing the hashed of password on the server. An attacker will try to find your password.
Second Pre-image resistant: if it is hard to find an $h'$ such that $h' = Hash(m)$. Note that $h'$ can be equal to $h$. An attacker will try to find a working password, not necessarily yours.
Collision resistance : if it is hard to find two inputs that hash to the same output $a$ and $b$ such that $H(a)= H(b)$, $a \neq b.$
- a) As far as I understand, hashes are just long alphanumeric strings.
Hash outputs are bits, just bits. How you represent them or transmit them is up to the developer.
- b) If one computes hashes across all documents, keys, information, files, etc, over and over again- its simply a matter of time until the same combination comes up again for the different information
What you said is called a hash collision. By definition of hash, it is inevitable but the finding one must be computationally infeasible. But if your hash function is considered as weak or a new attack occurs you must change it as for MD5 or SHA1.
$$H:\{0,1\}^* \rightarrow \{0,1\}^l$$
As one can see, for $2^l$ possible hash output there are finitely (since we cannot process infinitely) many possible inputs. The SHA3-512 has only $l=512$ output bits. If the message space is just 1024 bits, then for a given hash value $h$ there are $ 2^{1024}/2^{512}$ possible input values that have $h$ as the hash value.
Picking one at random, you will have $1/2^{512}$ probability to match the hash as long as the hash function behaves randomly.
- c) This might be an impractical test given size and possibility, yes, but is it this that makes hashes powerful, that its practically impossible to recreate a hash that for any foreseeable endeavor its fine or is there some element that I'm missing that reduces even that extremely low probability to zero
In the designs of hash functions is it required that finding a pre,second-image and collision must be computationally infeasible. But there is always a negligible chance of the attacker to find one.
- Is there any design constraint that prevents a very powerful computer to back-calculate the original data from a hash? Or is it simply that the design is so complex that its simply a futile exercise to dream of such a large computer required for this task?
Hash functions are by design are not invertible as permutations. The attacker must find either a preimage or secondary-preimage.
A powerful entity can search all possible inputs to match the given hash. These examples rainbow table,hashcat may be not as powerful as you imagine but they are on the edge of computing.
If somehow you find an image that works for the hash value, there is no way to determine that this is the original one, the pre-image.
- Whats stopping a hacker or malicious middle man to hack open the software program or library that creates this "hash" and then use that library to create hashes of his own or mislabel some target company's hash with his own pointing to their version of the file? Especially since many applications, languages, and developers use hashing independently. Whichever is most weakly secured, we can use that to take on the rest?
Nothing except the hardness of finding a collision. If somehow the attackers are able to find a collision as in the malicious valid PDF creating in SHA1, they can execute it.
