Alright, so I know this may sound dumb, but I'm having a hard time understanding what an encryption would be since it's different from a hash. I've read up on it, but I'm still not quite sure. So, I was hoping you guys could help me with it.
|
Encryption vs. HashingNobody really "encrypts" a password, although you could... but you'd be encrypting it with another password, and you would need that password to decrypt the first password. When it comes to passwords, we normally hash them.
Ghetto Flowchart ExamplesI made a couple flowcharts that are overly simplified. Hope it helps.
See the above? It doesn't make any sense that you would get the "message" back. Why? You're already entering the password, which is the "message" itself. Now look at this:
With encryption, you're getting the encrypted message back if the key is correct. You don't get the password back, you use it to unlock the contents. With hashing, you already have the "message" if it validates, or a collision. What you enter is the message. |
|||||||||||||||||||||
|
|
A hash is an irreversible process: one function, 'hash' which cannot be "reversed". Once you have a hash, you can only guess the original password via a brute force attack, which involves hashing a variety of possible passwords until you end up with the same hash value, which indicates that the password you guessed is the same as the original. Encryption is a reversible process: two functions, 'encryption' <-> 'decryption'; that which is encrypted can be decrypted if you have the key; decryption recovers the original password without guessing. The security of a hashed password depends largely on the amount of computation required to perform the hash function. The more computation required, the longer it takes; since a brute force attack must repeat that computation for thousands or millions of possible passwords, the longer each individual hash computation takes the less practical the attack becomes. The security of an encrypted password depends on the soundness of the algorithm and the secret of the key. The benefit of hashing is that no key is required, which improves the overall security of the system - one less secret piece to be kept out of the hands of the attacker. |
|||
|
|
