15

As I understand it, a hashing algorithm is some kind of encryption, just a specific kind of it. So is it wrong to say "I encrypted this value." if I "only" hash it?

I understand that it gives the wrong impression, but I think it is not absolutely wrong, or is it?

RonJohn
  • 105
  • 2

8 Answers8

53

Encryption algorithms and hash algorithms both belong to the realm of cryptography but are two different things: Encryption doesn't contain hash functions.

As stated on Wikipedia:

In cryptography, encryption is the process of encoding a message or information in such a way that only authorized parties can access it and those who are not authorized cannot.

An encryption algorithm turns some data into a ciphertext which can later be decrypted again to its original content by using the encryption key.

If you generate a hash of some data it can't be "reversed" back into its original content, because a hash function is (theoretically) a one-way function with loss of data.

AleksanderCH
  • 6,511
  • 10
  • 31
  • 64
20

Encryption implies that with the appropriate key, it is possible to decrypt and recover the original message. Which (in general) is not possible from a hash.

Thus “I will encrypt” is not adequate if one is going to hash.

While it is possible to construct hashes from encryption primitives (such as block ciphers), and vice versa, they are different beasts.

fgrieu
  • 149,326
  • 13
  • 324
  • 622
13

I understand that it gives the wrong impression, but I think it is not absolutely wrong, or is it?

It is actually. A hash algorithm computes a 'fingerprint' if you will of the input. So just as a fingerprint identifies you, a hash identifies the input document.

But just as an entire human being cannot be recreated from just a fingerprint, so the original document cannot be (easily) recreated from the hash. This is the fundamental distinction with an encryption. In encryption it's useful to decrypt, using the original encryption key. You can't with a hash, and it has no key.

Paul Uszak
  • 15,905
  • 2
  • 32
  • 83
2

I agree with other answers, but would like to add this: when talking to someone familiar with cryptography or fields using it (e.g. programming), you should indeed use the right vocabulary. But if you try to summarize what you are doing to a client, I would use neither and say something like "we store our password in a secure way" and eventually provide details somewhere else.

Lou_is
  • 129
  • 3
1

I'm assuming this is something the user will get to see later? If that's the case I'd recommend just writing "hash" with a short explanation of what that means.

Something like:

Hash means that whatever it's used for is uniquely identifiable, but not reconstructible.

Even though in rare cases hashes overlap and therefore aren't 100% unique, if you're target audience isn't tech savvy - I'd just leave that out because it would add unnecessary complexity to the statement.

Maarten Bodewes
  • 96,351
  • 14
  • 169
  • 323
Martin
  • 11
  • 1
1

You will hurt yourself if you claim it is encryption, because (especially for password hashing) if a review is done password encryption (I.e. reversible encryption) should be flagged as a policy violation. So it is better to never use a incorrect term (in this assumed context). Otherwise you will have to do some back and forth to explain the actual method used.

Of course if you are not in a enterprise setting this might not apply to you (but there is still nothing gained from using the wrong terms)

eckes
  • 666
  • 5
  • 11
0

I just wanted to add a confusing, and weird phenomena, where laypeople,(e.g. journalists), very often conflate encryption and hashing.

It often happens when data leaks are reported and the news article says something like "encrypted passwords were leaked". What they mean 99% of the time is that "hashed passwords were leaked".

Here's a likely example from today's Twitch data leak:

Some Twitter users have started making their way through the 125GB of information that has leaked, with one claiming that the torrent also includes encrypted passwords, and recommending that users enable two-factor authentication to be safe.

stevec
  • 123
  • 3
-1

Typically we require encryption be reversible, so it can be used as a communication system.

Mathematically, when we talk about a cryptographic system, we are focusing on invertible functions. This change in viewpoint is important, because it opens up the possibilities for how we can encrypt information.

For example, we can use a linear function (affine transformation) as an encryption system:

https://youtu.be/1S92scw5zIg?list=PLKXdxQAT3tCssgaWOy5vKXAR4WTPpRVYK