Kategorya
Hashing at crypto
Lahat ng kagamitan at artikulo sa kategoryang ito, tinipon sa isang lugar.
Mga Kagamitan
Hash Generator (SHA-1/256/384/512)
Kuwentahin ang SHA-1, SHA-256, SHA-384, at SHA-512 na mga digest ng anumang teksto, ipinapakita bilang hex at Base64, gamit ang native na Web Crypto ng browser. Tumatakbo nang buo sa iyong browser.
Hash Preimage Finder
Watch a bounded, local brute-force search recover a weak hash input in seconds, or run out of keyspace on anything with real entropy. No wordlist, no table, just your browser. A demonstration of why fast, unsalted hashes fail.
HMAC Generator (SHA-256/384/512)
Kuwentahin ang isang keyed HMAC sa isang mensahe gamit ang iyong secret key, ipinapakita bilang hex at Base64, sa pamamagitan ng native na Web Crypto ng browser. Ang parehong konstruksyon na ginagamit ng JWT verifier para sa HS256. Hindi umaalis ang iyong key sa iyong browser.
Mga Artikulo
Hashing, encryption, at encoding: tatlong magkaibang bagay
Tatlong operasyong palaging napagkakamalan, malinis na pinaghihiwalay ng dalawang tanong: maibabalik ba ito, at nangangailangan ba ito ng susi?
BasahinCryptographic hashing: SHA-256 at ang pamilyang SHA-2
Ano ang ginagarantiya ng isang hash function, ang mga katangiang nagpapagawa nitong cryptographic, at bakit ang digest ay hindi pag-encrypt.
BasahinPagpili ng hash: MD5, SHA-1, SHA-2, SHA-3, at BLAKE
Aling mga hash function ang ligtas pa, alin ang nasira, ang kanilang mga laki ng output, at paano piliin ang tama.
BasahinMga collision, preimage resistance, at ang birthday bound
Ang tatlong katangian ng seguridad na dapat taglayin ng isang cryptographic hash, bakit mahalaga ang mga collision, at ang matematika ng birthday na nagtatakda ng tunay na lakas.
BasahinPag-iimbak ng mga password: bcrypt, scrypt, at Argon2
Bakit ang isang mabilis na hash tulad ng SHA-256 ay maling kasangkapan para sa mga password, at ano talaga ang ginagawa ng salting at mga work factor.
BasahinHMAC: keyed hashing para sa message authentication
Bakit pinatutunayan ng payak na hash ang integridad ngunit hindi ang pagiging tunay, paano ito inaayos ng isang lihim na susi, at bakit mahalaga ang istruktura ng HMAC.
BasahinBakit HMAC, at hindi hash(susi + mensahe)
Ang length-extension attack na sumisira sa walang-muwang na keyed hashing, at ang nested na construction na ginagamit ng HMAC upang talunin ito.
BasahinPag-authenticate ng API requests gamit ang HMAC
Paano hinahayaan ng isang ibinahaging lihim at isang hash ang isang server na magtiwala sa isang request na hindi nito nakitang ginawa, at paano umaangkop ang replay protection.
BasahinLigtas na pag-verify ng HMAC: constant time at replay
Bakit naglalabas ng timing side channel ang paghahambing ng mga lagda gamit ang ==, at bakit hindi pinipigilan ng wastong lagda lamang ang isang inulit na request.
BasahinWhy Cryptographic Hashes Are One-Way
A cryptographic hash maps any input to a fixed-size digest and is designed so that recovering the input from the digest is infeasible. That property, preimage resistance, is why you cannot decrypt a hash. The only ways to reverse one are to look it up or to guess-and-check, both of which are search, not inversion.
BasahinBrute Force vs Lookup Tables: Two Ways to Reverse a Hash
Since a hash cannot be inverted, reversing one means searching, and there are two families. Precompute a giant table of input-to-hash pairs and look the hash up (what CrackStation does), or generate candidates on the fly and hash each until one matches (brute force). They trade storage for compute in opposite directions.
BasahinWhy Salting Defeats Precomputed Tables
A salt is a unique random value stored with each password hash and mixed in before hashing. It makes identical passwords hash differently, which destroys the economics of precomputed tables: an attacker would need a separate table for every salt. Salting is the specific defense that neutralizes lookup services and rainbow tables.
BasahinSlow KDFs: bcrypt, scrypt, and Argon2
Salting defeats precomputation but not a targeted guess-and-check attack; a fast hash still lets an attacker try billions of candidates per second. Slow key derivation functions fix that by making each guess deliberately expensive and tunable, cutting an attacker's rate by many orders of magnitude. These are what you should store passwords with.
BasahinKeyspace, Entropy, and Crack Time
Whether brute force can reverse a hash comes down to keyspace size versus the attacker's hashing rate. Keyspace grows exponentially with length and alphabet, so a few extra characters move a secret from cracked in seconds to infeasible for millennia. This is the arithmetic behind why length and randomness matter most.
BasahinChoosing a Password Hash
Storing passwords safely is a solved problem: use a purpose-built, salted, slow password hash, not a raw digest. This is a short decision guide, from the algorithm to pick to the parameters to set and the mistakes to avoid, aligned with OWASP and NIST guidance.
Basahin