0Pricing
Cryptology Academy · Lesson

Hash Applications: Checksums, HMAC & Git

See hashes in password storage, data integrity, and version control.

Hash Applications: Checksums, HMAC & Git is a free Cryptology Academy lesson on CoddyKit — lesson 4 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Cryptology Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

Welcome

Hash functions serve three critical roles in real systems: verifying data integrity (checksums), authenticating messages (HMAC), and tracking code history (Git).

File Checksums

When downloading software, providers publish the SHA-256 hash. After downloading, you compute the hash and compare: sha256sum ubuntu-24.04.iso # Should match published value exactly

Data Integrity in Storage

Databases like ZFS and Btrfs compute SHA-256 checksums for every data block. On read, the checksum is verified. Silent disk corruption is detected automatically.

Content-Addressed Storage

Git, IPFS, and Docker use content-addressable storage: each object's name IS its hash. SHA-256(content) = unique ID. Identical content stored once, duplicates detected instantly.

Git's Use of SHA-1 (and SHA-256)

Every Git commit, tree, and blob has a SHA-1 hash. The commit hash covers: content + metadata + parent hashes. Changing any bit changes the hash, making history tamper-evident.

HMAC Construction

HMAC-SHA256(key, msg) = SHA256((key' XOR opad) || SHA256((key' XOR ipad) || msg)) The double-hash construction with XOR pads prevents length-extension attacks against keyed MACs.

HMAC in Python

import hmac, hashlib def create_mac(key: bytes, msg: bytes) -> str: return hmac.new(key, msg, hashlib.sha256).hexdigest() mac = create_mac(b'secret', b'Hello!')

Constant-Time Comparison

Always compare HMACs with hmac.compare_digest(), NOT ==. Timing attacks: early-exit comparison leaks length of match. hmac.compare_digest compares all bytes in constant time.

HMAC in API Authentication

GitHub webhooks: each payload is signed with HMAC-SHA256 using a shared secret. Receive webhook → compute HMAC → compare with X-Hub-Signature-256 header.

Password Verification with Hash

Login flow: user submits password → server computes hash → compare with stored hash. The server never decrypts; it re-hashes and compares. Stored hash never reveals the password.

Merkle Tree Applications

Merkle trees build a hash tree over data. Bitcoin blocks contain a Merkle root of all transactions. Certificate Transparency uses Merkle trees for tamper-evident audit logs.

Quick Check

Why must HMAC comparisons use hmac.compare_digest() instead of ==?

Recap

Excellent! You've applied hashes in real scenarios. Next we go deeper into AES — the world's most deployed symmetric encryption standard.

Frequently asked questions

Is the “Hash Applications: Checksums, HMAC & Git” lesson free?

Yes — the full text of “Hash Applications: Checksums, HMAC & Git” is free to read here on the web, and the Cryptology Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Cryptology Academy course, upgrade to CoddyKit PRO.

What will I learn in “Hash Applications: Checksums, HMAC & Git”?

See hashes in password storage, data integrity, and version control. You practise Cryptology Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start Cryptology Academy?

No prior experience is required. Cryptology Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 4 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “Hash Applications: Checksums, HMAC & Git” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this Cryptology Academy lesson?

Yes. Every Cryptology Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

  1. What Makes a Good Hash Function
  2. MD5: History, Uses & Why It Is Broken
  3. SHA-1 & SHA-2 Family Explained
  4. Hash Applications: Checksums, HMAC & Git
← Back to Cryptology Academy