In this lesson,
we will learn about data integrity.
Data integrity ensures the accuracy, consistency,
and reliability of data throughout its lifecycle.
It guarantees that data hasn't been changed and is complete.
Hashing is a technique used to validate data integrity.
Hashing algorithms utilize one-way cryptographic functions
to convert any size input into a fixed size output
that uniquely represents the original data,
and cannot be reversed-engineered.
Let's learn more about how hashing is used
to validate data integrity.
Hashing is a fundamental part of network security,
primarily used to validate data integrity.
A hashing function is a one-way cryptographic algorithm
that takes an input of any length
and transforms it into a fixed-length output
called a hash digest.
This digest acts like a digital fingerprint
for the original data,
ensuring that even the slightest change in data
will result in a dramatically different hash output.
Hash functions are designed so that it's impossible
to reverse-engineer the original data from the hash,
making them ideal for verifying
whether data has been altered
during transmission or storage.
Three characteristics make hashing algorithms reliable.
First, they must always produce a fixed-length output
regardless of the input size.
For instance, the MD5 hashing algorithm
always generates 128-bit digest,
represented by 32 hexamal digits.
Whether you hash a single word or an entire book,
the output is always the same size.
Second, for hashing algorithms,
the same input will always produce the same output,
ensuring consistency and reliability
across different systems.
Third, the output of a hashing function
cannot be used to recreate the input,
emphasizing the one-way or trapdoor nature of hashing.
This characteristic ensures
that the hash cannot be reverse-engineered
to reveal the original data.
But while hashing algorithms are needed,
they are not all equally secure.
The MD5 algorithm was once popular
but is now considered vulnerable
because it generates only a 128-bit hash,
which makes it prone to collisions.
A collision occurs
when two different inputs produce the same output,
undermining the integrity of the validation process.
This MD5 collision vulnerability
led to the development of the Secure Hash Algorithm,
or SHA, family of hashing algorithms.
SHA-1, which produces a 160-bit digest,
was more secure than MD5,
but eventually encountered similar collision issues.
The SHA-2 family,
with digests ranging from 224 to 512 bits,
significantly reduces the chance of collisions,
making it a much more secure option.
SHA-3, the latest version, enhances security further
with up to 120 rounds of computation.
Another important hashing algorithm
is the RACE Integrity Primitives Evaluation Message Digest,
(RIPEMD).
Developed independently of government influence,
RIPEMD has become popular among privacy advocates.
RIPEMD offers digests of different lengths,
such as 128, 160, 256, and 320 bits.
Although less commonly used than the SHA family,
RIPEMD is used in applications
like Pretty Good Privacy and Bitcoin,
which value privacy and decentralized control.
Overall, hashing has several practical applications,
one of which is ensuring that files
have not been modified during transfer.
For example, if I create a file and send it to you,
along with its hash digest that I created,
you can generate a hash from the received file,
just like I did, using the same algorithm.
And then you can compare the two digests,
the one that you created and the one that I sent.
If the hashes match,
you can be confident that the file that I sent
was not altered between me sending it and you receiving it.
This is because even minor changes,
such as modifying a single character in the original data,
result in a drastically different hash output.
So it would be easy to tell
if the file's integrity had been compromised.
Another common use of hashing is verifying the integrity
of software downloads and updates.
You will often see a vendor hash value
listed alongside a file when downloading new software.
By generating a hash of the downloaded file
and comparing it to the vendor-provided hash,
you can confirm, if they match,
that the file has not been tampered with.
This simple but effective technique
helps maintain the integrity of critical files
without requiring complex security measures.
Hashing is also essential in file integrity management
(FIM).
File integrity management is a security process
that monitors and detects changes in files
that could indicate malicious activity.
File integrity management tools
create a baseline hash digest for critical files,
and then continuously monitors those files
for any modifications.
If a file is altered,
the new hash digest will differ from the baseline,
triggering an alert.
For instance,
if an attacker modifies a system configuration file
or installs unauthorized software,
file integrity management will detect the change,
allowing security teams to respond quickly.
Tools such as Tripwire,
open source security information management (OSSEC),
and Advanced Intrusion Detection Environment (AIDE),
use hashing algorithms
to continuously check the integrity of files,
comparing current hashes to known good ones
to detect unauthorized changes.
Finally, digital signatures are a key application of hashing
that combine integrity with non-repudiation,
ensuring both the authenticity of a message
and its integrity.
When sending a signed email,
the email content is first hashed using a hashing algorithm.
This creates a hash digest.
This digest, not the entire email content,
is then encrypted with the sender's private key,
forming the digital signature.
The signature is attached to the email,
ensuring that the actual content
remains unaltered during this process.
Upon receiving the signed email,
the recipient uses the sender's public key
to decrypt the digital signature,
revealing the original hash digest
that was created by the sender.
The recipient's email client then independently hashes
the email content that was received
using the same hashing algorithm used by the sender
when they created their hash digest.
Then, if the decrypted hash digest
matches the hash generated by the recipient,
it confirms that the message
has not been altered since it was signed.
This process not only validates
the integrity of the message,
but it also ensures non-repudiation,
meaning the sender cannot deny having sent the message.
This is because that original hash digest
was signed by the sender's private key
to create the digital signature.
And only the sender has access to their private key.
So if, upon receipt,
the recipient is able to decrypt the digital signature,
the sender can't deny having sent that message.
So remember, hashing is a key part of network security
used to ensure data remains unchanged.
A hashing function takes any size of data
and turns it into a fixed-length string
called a hash digest.
Reliable hashing algorithms
always produce the same length of hash digest,
give the same result for the same input,
and cannot be reversed to reveal the original data.
While some hashing algorithms like MD5 are no longer secure,
newer ones, like SHA-2, SHA-3, and RIPEMD,
offer stronger protection
against vulnerabilities and collision.
Overall, hashing is used
to verify the integrity of software downloads,
manage file integrity,
and secure digital communications with digital signatures,
making it essential for keeping data safe and trustworthy.