Hashing Algorithms Deep Dive

Also Known As

TL;DR

Explanation

Hash functions serve different purposes: Cryptographic hashes (SHA-256, SHA-3, BLAKE3) — collision and pre-image resistant, for data integrity and HMACs. Password hashing (bcrypt, Argon2id, scrypt) — deliberately slow, memory-hard, salted. Non-cryptographic hashes (xxHash, MurmurHash, CRC32) — extremely fast, not collision-resistant, for hash tables and checksums where security is not required. MD5 and SHA-1 are broken (collision attacks demonstrated) — never use for security. PHP: hash() for cryptographic, password_hash() for passwords, crc32() for non-security checksums.

Common Misconception

Why It Matters

Common Mistakes

• SHA-256 or MD5 for passwords — fast algorithms, GPU-crackable at billions per second.
• bcrypt for non-security checksums — 400ms per hash where 1 microsecond is sufficient.
• MD5 for file integrity — collision attacks allow two different files with the same MD5.
• CRC32 for security applications — CRC32 is not cryptographic and easily forged.

Code Examples

// Wrong hash for the job:
$passwordHash = hash('sha256', $password);  // GPU-crackable in seconds
$checksum     = password_hash($data, PASSWORD_BCRYPT); // 400ms for a file checksum!
$fileInteg    = md5_file($upload);          // Collision-vulnerable integrity check

// Right hash for each use case:

// Passwords — slow, memory-hard:
$passwordHash = password_hash($password, PASSWORD_ARGON2ID);

// File integrity — cryptographic, collision-resistant:
$checksum = hash_file('sha256', $uploadPath);

// HMAC — authenticated integrity:
$mac = hash_hmac('sha256', $message, $secretKey);

// Cache key (non-security) — fast:
$cacheKey = 'page:' . crc32($url . $queryString); // Fast, not security

// Constant-time comparison for all security-sensitive comparisons:
if (!hash_equals($expected, $computed)) throw new SecurityException();

References

• ↗ https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html

Tags

Related Terms