Hashing

What it is

A hash function takes an input of arbitrary length and produces a fixed-length digest. It is one-way: you cannot recover the input from the digest. It is deterministic: the same input always yields the same digest, which makes it useful for integrity and verifier storage.

Why it matters

Hashing underpins software integrity (matching a downloaded file against the vendor’s published digest), password storage (storing a verifier instead of a plaintext secret), and phishing/IOC checks (hashing a binary to identify known malware). Broken or weak hashes compromise all of these.

How it works

• Collision resistance: two different inputs must not produce the same digest. SHA-256 is preferred; older MD5/SHA-1 are weak.
• Password hashing ≠ fast hashing: for passwords, use a slow, salted key-derivation function (Argon2id, scrypt, bcrypt, PBKDF2) to resist offline guessing (see guides:password-security).
• Usage: file/artifact fingerprinting, integrity manifests, and password verifiers. Do not use a plain hash as a password verifier without salt + slow KDF.

Detection

• Policy scans flagging MD5/SHA-1 usages.
• A downloaded file whose computed digest mismatches the vendor’s published value → treat as tampered.
• Check an artifact against known-malware hashes in Threat Intelligence (IOC lookup).

Mitigation

• Standardize on SHA-256+ for integrity; reject weak algorithms in CI.
• Store passwords only as salted slow-KDF verifiers; rotate on compromise.
• Publish and verify official checksums for releases.

Investigation

Use the Hash Checker tool to confirm whether an artifact matches a known-good or known-malicious digest, then pivot to origin and parent process. See guides:tool-hash-guide and guides:investigate-malware.