0Pricing
Cyber Security Academy · Lesson

Hash Functions: SHA-256 and Beyond

Explore cryptographic hash properties: collision resistance, preimage resistance, and applications.

Hash Functions: SHA-256 and Beyond is a free Cyber Security Academy lesson on CoddyKit — lesson 3 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Cyber Security Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

What is a Cryptographic Hash Function?

A cryptographic hash function takes arbitrary-length input and produces a fixed-length output (digest). It must be: deterministic, fast to compute, preimage-resistant (can't reverse), collision-resistant (can't find two inputs with same hash), and avalanche-sensitive (small change → completely different hash).

SHA-2 Family

The SHA-2 family (designed by NSA, standardized by NIST) includes:

  • SHA-256 — 256-bit output, widely used
  • SHA-384 — 384-bit output
  • SHA-512 — 512-bit output, faster on 64-bit CPUs

SHA-256 is used in Bitcoin, TLS certificates, and Git commit IDs.

SHA-3 Family

SHA-3 uses a completely different design (Keccak sponge construction) from SHA-2. It was standardized as a backup in case SHA-2 weaknesses are found. SHA-3 is not widely deployed but is used in some cryptographic protocols and hardware.

MD5 and SHA-1: Broken

Never use MD5 or SHA-1 for security purposes:

  • MD5: collision found in seconds with commodity hardware
  • SHA-1: first practical collision demonstrated in 2017 (SHAttered)

They remain useful for non-security checksums (file deduplication) but not for integrity guarantees.

Hash Uses: File Integrity

Verifying downloads:

sha256sum ubuntu-24.04.iso
# Compare with the hash published on the official site
# If hashes match, file is unmodified

Hash Uses: Digital Signatures

When signing documents, we don't encrypt the full document with the private key (too slow). Instead, we:

  1. Hash the document (fast)
  2. Encrypt the hash with the private key (small, fast)
  3. Recipient decrypts with public key and compares to their own computed hash

HMAC: Keyed Hash for Integrity

HMAC (Hash-based Message Authentication Code) combines a hash function with a secret key to produce an authentication tag. Used to verify both data integrity and authenticity. Used in JWTs, API authentication, and TLS.

import hmac, hashlib
mac = hmac.new(key, message, hashlib.sha256).hexdigest()

Hash Length Extension Attacks

SHA-2 (Merkle-Damgård construction) is vulnerable to length extension attacks: if you know H(secret+message), you can compute H(secret+message+extension) without knowing the secret. HMAC prevents this. SHA-3 is not vulnerable.

Rainbow Tables and Salting

A rainbow table precomputes hash → input mappings for fast lookup. Salting prevents this: adding a unique random value per input makes each hash unique, requiring a full brute-force per entry rather than a lookup.

Merkle Trees

A Merkle tree is a tree of hashes where each parent node is the hash of its children. Used in Bitcoin blockchain, Git, and certificate transparency logs to efficiently verify large datasets without downloading everything.

Choosing the Right Hash

Selection guide:

  • General integrity/checksums: SHA-256
  • Password storage: Argon2id, bcrypt (NOT SHA-256 directly)
  • Message authentication: HMAC-SHA-256
  • Digital signatures: SHA-256 or SHA-384 as the underlying hash
  • Avoid: MD5, SHA-1 for security applications

Quick Check: Hash Functions

Which construction prevents length extension attacks while also requiring a secret key?

Lesson Recap

Hash functions produce fixed-length digests from arbitrary input. SHA-256 and SHA-512 are the current standards. MD5 and SHA-1 are broken for security. HMAC adds a secret key for authenticated integrity. Use Argon2/bcrypt for passwords. Merkle trees extend hashing to efficiently verify large datasets.

Frequently asked questions

Is the “Hash Functions: SHA-256 and Beyond” lesson free?

Yes — the full text of “Hash Functions: SHA-256 and Beyond” is free to read here on the web, and the Cyber Security Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Cyber Security Academy course, upgrade to CoddyKit PRO.

What will I learn in “Hash Functions: SHA-256 and Beyond”?

Explore cryptographic hash properties: collision resistance, preimage resistance, and applications. You practise Cyber Security Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start Cyber Security Academy?

No prior experience is required. Cyber Security Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 3 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “Hash Functions: SHA-256 and Beyond” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this Cyber Security Academy lesson?

Yes. Every Cyber Security Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

  1. Symmetric Encryption: AES and Stream Ciphers
  2. Asymmetric Encryption: RSA and Elliptic Curves
  3. Hash Functions: SHA-256 and Beyond
  4. Digital Signatures and Certificates
← Back to Cyber Security Academy