PATCH//NOTES Open the interactive version
← All lessons
Foundations · Beginner · 5 min

Encryption & hashing

Locks, keys and fingerprints for data.

What it is

Encryption scrambles data so only someone with the key can read it. Symmetric encryption (AES) uses one shared key. Asymmetric encryption (RSA, elliptic curve) uses a public key to lock and a private key to unlock, which is how HTTPS starts a secure connection with a site you've never met. Hashing is different: it's a one-way fingerprint. You can't reverse it, so sites store password hashes, ideally with slow algorithms like bcrypt or Argon2 plus a unique salt.

See it: How HTTPS (TLS) protects you on shared Wi-Fi

  1. Your browser → bank.example: Hello: let's talk securely. Your browser starts a TLS connection and offers the encryption methods it supports.
  2. bank.example → Your browser: Certificate proving it's bank.example. The server sends a certificate signed by a trusted authority, so you know it's the real site.
  3. Your browser → bank.example: Key exchange. Both sides work out the same secret key using public-key maths, without ever sending the key itself.
  4. Your browser → bank.example: Encrypted data. Everything after that, such as your password and balance, is encrypted with the shared key. The eavesdropper only sees scrambled bytes. Stopped by: Use TLS everywhere, and never click through certificate warnings.

Step through the animated diagram in the app.

Real case · 2012

LinkedIn

In 2012 about 6.5 million LinkedIn password hashes were posted online; in 2016 it emerged the same breach covered about 117 million accounts. The hashes used SHA-1 with no salt, so attackers cracked most of them quickly with precomputed tables.

Source: Wikipedia: 2012 LinkedIn hack

How defenders stop it

  • Use TLS everywhere
  • Hash passwords with bcrypt, scrypt or Argon2 and a salt
  • Never write your own crypto; use vetted libraries
  • Protect and rotate keys (key management is the hard part)

Try it yourself

Learn by breaking crypto on CryptoHack

Check yourself

1. Why do sites hash passwords instead of encrypting them?

  1. Hashing is faster to reverse
  2. Hashes can't be turned back into the password, so a leak reveals less
  3. Encryption is illegal for passwords
  4. Hashes are shorter
Show answer

Hashes can't be turned back into the password, so a leak reveals less. The site only needs to check a match, never read the original.

2. Which kind of encryption uses a public key to lock and a private key to unlock?

  1. Symmetric, such as AES
  2. Hashing
  3. Asymmetric, such as RSA or elliptic curve
  4. Base64 encoding
Show answer

Asymmetric, such as RSA or elliptic curve. Asymmetric encryption is how HTTPS starts a secure connection with a site you've never met. Then both sides switch to a fast shared key.

3. Why should each password hash use a unique salt?

  1. So the hash can be reversed later
  2. To encrypt the whole database
  3. So identical passwords get different hashes and precomputed tables don't work
  4. To make the hash shorter
Show answer

So identical passwords get different hashes and precomputed tables don't work. A salt is random data added before hashing, so attackers can't crack many identical passwords at once with ready-made tables.

Answer them in the app to earn XP.

Next: Linux command line →