PricingLoginStart free
Cryptology Academy · Lesson

Hash Applications: Checksums, HMAC & Git

See hashes in password storage, data integrity, and version control.

Lesson 4 of 413 steps

Hash Applications: Checksums, HMAC & Git is a free Cryptology Academy lesson on CoddyKit. This is lesson 4 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Cryptology Academy learning path, and your progress syncs across the web and the CoddyKit app. The Cryptology Academy course includes 4 lessons in total.

Welcome

Hash functions serve three critical roles in real systems: verifying data integrity (checksums), authenticating messages (HMAC), and tracking code history (Git).

File Checksums

When downloading software, providers publish the SHA-256 hash. After downloading, you compute the hash and compare: sha256sum ubuntu-24.04.iso # Should match published value exactly

Data Integrity in Storage

Databases like ZFS and Btrfs compute SHA-256 checksums for every data block. On read, the checksum is verified. Silent disk corruption is detected automatically.

Content-Addressed Storage

Git, IPFS, and Docker use content-addressable storage: each object's name IS its hash. SHA-256(content) = unique ID. Identical content stored once, duplicates detected instantly.

Git's Use of SHA-1 (and SHA-256)

Every Git commit, tree, and blob has a SHA-1 hash. The commit hash covers: content + metadata + parent hashes. Changing any bit changes the hash, making history tamper-evident.

HMAC Construction

HMAC-SHA256(key, msg) = SHA256((key' XOR opad) || SHA256((key' XOR ipad) || msg)) The double-hash construction with XOR pads prevents length-extension attacks against keyed MACs.

HMAC in Python

import hmac, hashlib def create_mac(key: bytes, msg: bytes) -> str: return hmac.new(key, msg, hashlib.sha256).hexdigest() mac = create_mac(b'secret', b'Hello!')

Constant-Time Comparison

Always compare HMACs with hmac.compare_digest(), NOT ==. Timing attacks: early-exit comparison leaks length of match. hmac.compare_digest compares all bytes in constant time.

HMAC in API Authentication

GitHub webhooks: each payload is signed with HMAC-SHA256 using a shared secret. Receive webhook → compute HMAC → compare with X-Hub-Signature-256 header.

Password Verification with Hash

Login flow: user submits password → server computes hash → compare with stored hash. The server never decrypts; it re-hashes and compares. Stored hash never reveals the password.

Merkle Tree Applications

Merkle trees build a hash tree over data. Bitcoin blocks contain a Merkle root of all transactions. Certificate Transparency uses Merkle trees for tamper-evident audit logs.

Quick Check

Why must HMAC comparisons use hmac.compare_digest() instead of ==?
Answer it in the interactive lesson

Recap

Excellent! You've applied hashes in real scenarios. Next we go deeper into AES — the world's most deployed symmetric encryption standard.
Free to start

Learn Cryptology Academy with an AI tutor — free

Write and run real code in your browser, get instant help from a 24/7 AI tutor, and pick up where you left off on the web or in the app.

Courses
67
Lessons
261
Start learning freeView the full course

Frequently Asked Questions

Is the “Hash Applications: Checksums, HMAC & Git” lesson free?

Yes — the full text of “Hash Applications: Checksums, HMAC & Git” is free to read here on the web. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Cryptology Academy course, upgrade to CoddyKit PRO. The Cryptology Academy course includes 4 lessons in total.

What will I learn in “Hash Applications: Checksums, HMAC & Git”?

See hashes in password storage, data integrity, and version control. You practise Cryptology Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start Cryptology Academy?

No prior experience is required. Cryptology Academy on CoddyKit is structured for beginners through advanced learners, so you can start here or from the beginning and move at your own pace. This is lesson 4 of 4.

How long does the “Hash Applications: Checksums, HMAC & Git” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this Cryptology Academy lesson?

Yes. Every Cryptology Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

  1. What Makes a Good Hash Function
  2. MD5: History, Uses & Why It Is Broken
  3. SHA-1 & SHA-2 Family Explained
  4. Hash Applications: Checksums, HMAC & Git
← Back to Cryptology Academy