3 ms·

Sha is a cryptograpic algo used for secure hashing hence the name SHA. The main goal of hashing is confirming the integrity of an object. This mean the object y

Sha is a cryptograpic algo used for secure hashing hence the name SHA. The main goal of hashing is confirming the integrity of an object. This mean the object you read now is the same object as when it was stored. The goal was never to encrypt even if its possible to do so. All hashing functions have the same weakness which is vulnerable to rainbow table attack. I agree with the OP that sha is dangerous if used in the wrong way.

danbruc 8y ago
The main goal of hashing is confirming the integrity of an object. [...] The goal was never to encrypt even if its possible to do so. That is not true, cryptographic hash functions are just cryptographic primitives with certain guarantees about their behavior, they do not imply any usage. There is nothing fundamentally wrong with using a cryptographic hash functions as a building block for an encryption algorithm. The important thing is that almost no use case of cryptography requires exactly and only the guarantees provided by cryptographic hash functions. That is why they are most of the time used as building blocks of more complex algorithms and not on their own. Ensuring that a file was not modified while you did not look is just an exceptional case where just using a cryptographic hash functions alone may be good enough. But even in this case you might want to consider that an attacker may be able to change the file and its hash together and maybe you actually need an authenticated hash that can not be forged by an attacker. In that case a cryptographic hash functions would again be part of the algorithm but it would not be the only building block.
zokier 8y ago
sha256crypt != sha256 The hash function used here is not the problem. Notably for example scrypt also uses sha256 under the hood.
tialaramex 8y ago
The article is about sha256crypt, which is a salted, pessimised password hash. Despite the legacy name "crypt" this isn't about encryption, encrypting passwords isn't what anybody is trying to do here. Because it uses salt, all time-space trades including rainbow tables are irrelevant. If you struggle to see why, the simplest way to understand it is that you'd need to generate new tables for every single salt. The salts are random and different for each account.

danbruc 8y ago

The main goal of hashing is confirming the integrity of an object. [...] The goal was never to encrypt even if its possible to do so. That is not true, cryptographic hash functions are just cryptographic primitives with certain guarantees about their behavior, they do not imply any usage. There is nothing fundamentally wrong with using a cryptographic hash functions as a building block for an encryption algorithm. The important thing is that almost no use case of cryptography requires exactly and only the guarantees provided by cryptographic hash functions. That is why they are most of the time used as building blocks of more complex algorithms and not on their own. Ensuring that a file was not modified while you did not look is just an exceptional case where just using a cryptographic hash functions alone may be good enough. But even in this case you might want to consider that an attacker may be able to change the file and its hash together and maybe you actually need an authenticated hash that can not be forged by an attacker. In that case a cryptographic hash functions would again be part of the algorithm but it would not be the only building block.

zokier 8y ago

sha256crypt != sha256 The hash function used here is not the problem. Notably for example scrypt also uses sha256 under the hood.

tialaramex 8y ago

The article is about sha256crypt, which is a salted, pessimised password hash. Despite the legacy name "crypt" this isn't about encryption, encrypting passwords isn't what anybody is trying to do here. Because it uses salt, all time-space trades including rainbow tables are irrelevant. If you struggle to see why, the simplest way to understand it is that you'd need to generate new tables for every single salt. The salts are random and different for each account.