Hash Function (cryptographic hash function)

A cryptographic hash function takes data of any size and returns a fixed-size digest, for example 256 bits for SHA-256. It must be preimage resistant (given a digest, you cannot find an input that produces it), second-preimage resistant and collision resistant (you cannot find two inputs with the same digest), and any change to the input should produce an unrelated digest. Current choices include SHA-256, SHA-384 and SHA-3; MD5 and SHA-1 are broken for collision resistance.

Why it matters

Hashes sit underneath almost every part of TLS and PKI. A digital signature on a certificate is a signature over a hash of its contents, so a practical collision attack can let an attacker transfer a CA's signature to a forged certificate; researchers demonstrated exactly that with MD5 in 2008 by creating a rogue CA certificate. Hashes also produce certificate fingerprints, drive HMAC and HKDF key derivation, protect the handshake transcript in Finished messages, and build the Merkle trees of Certificate Transparency logs.

Example

A one-character change produces a completely different digest:

printf 'example.com' | openssl dgst -sha256
printf 'example.con' | openssl dgst -sha256
openssl x509 -in example.com.crt -noout -fingerprint -sha256

Common misconceptions

• "Hashing is a form of encryption." There is no key and no way to decrypt. For storing passwords, use slow dedicated functions such as bcrypt or Argon2 rather than a fast hash.
• "A matching fingerprint proves a certificate is trusted." A fingerprint only identifies one exact certificate; trust comes from validating its chain.
• "Any 128-bit-or-longer hash is fine." MD5 is 128 bits and SHA-1 is 160 bits, yet both have practical collisions; the algorithm matters, not only the output length.