Hashing Algorithms: Collisions, HMAC, and Choosing the Right One

A cryptographic hash takes input of any size and produces a fixed-length value. The same input always produces the same output, a different input almost certainly produces a different one, and the output reveals nothing about the input. Those properties support integrity checking, signatures, password storage and deduplication — and each use depends on a different property holding.

The three resistance properties

Preimage resistance — given a hash, it is infeasible to find any input producing it. This is the one-way property.

Second preimage resistance — given an input, it is infeasible to find a different input with the same hash.

Collision resistance — it is infeasible to find any two inputs with the same hash, where the attacker chooses both.

Collision resistance is the weakest to break and the one that falls first, because the attacker controls both inputs. It matters specifically where someone else will trust a hash over content you supplied — a certificate, a signed document — because the attacker prepares two documents with the same hash, gets the benign one signed, and presents the malicious one with the same signature.

The birthday paradox is why collision resistance is roughly half the hash length in bits: a 256-bit hash offers about 128 bits of collision resistance, and that arithmetic is worth remembering.

The algorithms

MD5 produces 128 bits and is thoroughly broken — collisions are generated in seconds, and practical attacks have forged certificates. It must not be used for anything security-relevant. It survives as a non-security checksum for detecting accidental corruption, and even there the continued use causes confusion.

SHA-1 produces 160 bits and is also broken, with demonstrated practical collisions. Deprecated for signatures and certificates everywhere, and still present in legacy systems and in some version control internals.

SHA-2 is the current workhorse — a family including SHA-256 and SHA-512, with no practical attacks. SHA-256 is the sensible default for general use.

SHA-3 uses a fundamentally different internal construction, standardized as insurance in case a structural weakness were found in the SHA-2 family. Not a replacement so much as a hedge.

RIPEMD-160 is an older European alternative, rarely encountered outside specific applications. BLAKE2 and BLAKE3 are modern, fast and secure, and increasingly used where performance matters.

Hashing is not encryption

Worth stating explicitly because it is a reliable exam trap. Hashing is one-way with no key and nothing to reverse. Encryption is two-way with a key. A question asking how to store passwords so they can be recovered is describing encryption; one asking how to verify them without storing them is describing hashing.

HMAC, and why a bare hash is not enough

A hash proves that data has not changed accidentally. It proves nothing against an attacker, because an attacker who modifies the data simply recomputes the hash — the algorithm is public and unkeyed. That is the same limitation as with CRC, at a different scale.

HMAC adds a secret key, so only someone holding it can produce a valid tag. It is constructed specifically to resist length extension attacks, which affect the naive approach of simply hashing a key concatenated with the message — and that construction detail is why HMAC exists as a defined scheme rather than an obvious combination.

The distinction to hold: use a hash for accidental corruption, an HMAC for deliberate tampering where both parties share a key, and a digital signature where you also need non-repudiation and the verifier has no shared secret — the asymmetric case under code signing.

HMAC is what webhook signatures and API request signing use, as under webhook security, and comparing tags requires a constant-time comparison to avoid leaking the correct value through timing.

Password hashing is different

The other reliable exam distinction. General-purpose hashes are designed to be fast, which is exactly wrong for passwords, because speed helps the attacker guessing billions of candidates.

Password storage requires a deliberately slow, salted, memory-hard function — bcrypt, scrypt or Argon2 — as covered under password hashing and offline cracking. SHA-256 is a correct choice for file integrity and a serious mistake for password storage.

Exam angles

Know preimage, second preimage and collision resistance and that collision resistance is roughly half the output length due to the birthday bound. Identify MD5 and SHA-1 as broken with practical collisions, and SHA-2 as the current standard. Distinguish hashing (one-way, no key) from encryption (reversible, keyed). Know HMAC as a keyed hash providing integrity and authenticity against deliberate modification, and purpose-built slow functions as the requirement for password storage.