Network foundations · Lesson 7 of 7
Hashing is not encryption
Encryption and hashing answer different questions. Choose based on whether authorized people must recover the original data or whether you need to compare a derived value.
Two jobs for the same data
Follow the sequence, or move one step at a time.
Reduced motion is on. Use Next step to explore without animation.
Read all 4 steps
- Start with an invoice
Fictional input: invoice total 42. These labels illustrate concepts; no cryptographic operation is performed.
- Encrypt for recovery
An encryption scheme produces ciphertext. Authorized decryption can recover the invoice using the appropriate key.
- Or hash for comparison
A hash produces a digest to compare. It is not designed to turn back into the invoice.
- Choose the right purpose
Keep recoverable invoices with appropriate encryption. Use a trusted reference for integrity checks and a dedicated scheme for passwords.
Choose by the job
Compare the parts before making a security decision.
- Read an invoice later
Use appropriate encryption and protect the keys.
- Compare file bytes
Compare a hash with a trusted expected digest.
- Verify a password
Use a dedicated salted password-hashing scheme.
Read the visualWhich statement correctly distinguishes hashing from encryption?
A hash is not designed for decryption. Matching a trusted digest helps check a file’s bytes, not its safety.
Recover with encryption
Encryption transforms readable data into ciphertext. Authorized decryption uses the appropriate key to recover the original. Key access is therefore part of the protection.
Compare with a hash
A cryptographic hash derives a fixed-length digest from input. It is not designed to be decrypted. Compare against a digest from a trusted source; an attacker who replaces both a file and its advertised digest can defeat a careless check.
Store passwords differently
Password storage needs a purpose-built password-hashing scheme with a unique salt and appropriate cost. A fast, ordinary file hash is not an adequate password-storage design.
Put it in context
A fictional team needs to read archived invoices next year, so recoverable encryption fits that need. Its password verifier should instead compare a properly derived password hash, rather than keep passwords ready for routine decryption.
Encrypt for authorized recovery. Hash for appropriate comparisons. Protect the source of the expected value.
Read the sources
Make it stick.
Try one short question to check your understanding and save this lesson to your progress.