The primary function of any information security program is to assure the confidentiality, integrity and availability of critical information systems. In other words, it’s to ensure the protection of information from unauthorized access, disclosure, modification or destruction. But, in our ever-connected world, what kind of tools can we use to accomplish that when information is dynamic, constantly moving between the three states (at rest, in use and in transit) and worse, between secure and non-secure environments? That’s where cryptographic algorithms come in.
There are three classes of cryptographic algorithms: symmetric algorithms, asymmetric algorithms and hash functions. Symmetric algorithms use a single key for both encryption and decryption. Asymmetric algorithms use two keys, one for encryption and another for decryption. In both cases, if you know the key you can decrypt and reverse back into the original source. And those are the main differentiators from hash functions. Hash functions don’t use any key to perform their task and only work in one direction, and it is not possible to reconstruct the source from the hash results.
Let’s discuss this further. A hash function takes a block of data of any length (a single word, a phrase, a text document, biometrics values, etc.) and returns a string value of a fixed length. This value is supposed to be unique to this block of data. This is kind of a unique signature so in the event the block of data changes, either by error during transit or by someone modifying it, the new signature or hash value will be different, raising the concern of loss of data integrity. In a perfect world, this hash function would be defined by the following properties:
• You cannot generate the original block of data from the hash value.
• You cannot change the original block of data without changing the hash value.
• You cannot generate the same hash value from two different blocks of data.
In the real world, the last property is called “collision resistance,” meaning it should be hard to find two blocks of data that generate the same hash value. Like anything in the real world, however, there are exceptions. Hash functions are mathematical algorithms that generate hash values. These algorithms are designed to run on digital systems. As such, there are physical limitations to these calculations and these limitations create the exceptions. For example, the hash function called SHA-256 is designed to provide a hash value of 256-bit (32-byte) in length for a given input block of data. This value is a positive integer in the interval [0, 2256). This is an extremely large data set but still imposes an upper limit. If the number of inputs is large enough, the possibility exists that two blocks of data will generate the same hash value. Even so, this possibility is very small. A good collision resistance hash function is a function that makes the possibility of creating the same hash value very small. In other words, it makes this process very difficult, either by consuming too much time or requiring large amounts of processing power to recreate.
Now with this basic understanding of how they work, let’s see where we can use hash functions. A short answer would be everywhere in our digital world. For example:
•Integrity validation for downloading files from online software stores. These stores have the hash values published next to each file so the end user can verify it after the download and be reasonably assured the file has not been modified.
•For storing authentication data (passwords, biometrics values, etc.). Best practice dictates that it is better to store hash values instead of the source data because if the network is compromised, the intruders can only see the hash values. Remember that it is not possible to derive the original source from the hashes.
•All valid Internet traffic relies on digital certificates, which are electronic means of establishing the identity of individuals or resources on the network. A key component of these certificates is a digital signature that is generated by a hash function.
•Hashes are also used in blockchain protocols. In simple terms, a blockchain is a public transaction ledger that stores transactions between multiple parties in a verifiable and permanent way. These transactions, called “blocks,” are hash values. A point to remember is that crypto currency and blockchain are two different technologies.
•Cryptocurrency is generated using hash functions, and the result is a hash value that should be lower than the target block defined by the blockchain protocol.
The intention of this brief article is to point out how important hash functions are in our present-day digital world, and for tomorrow as we continue expanding into cloud computing, internet of things, quantum computing, machine learning, etc. They will continue playing an ever more important role in securing this new world.
Marlon Ortiz, Information Technology Professional. Creative professional with 20+ years of information technology knowledge in the gaming and hospitality industry. Highly skilled in information security, project management and planning with a strong background in data management, security, analytics and technical strategy. A proven leader who understands that the value of IT lies in delivering solutions to complex business problems within the Gaming and Hospitality Industry. Marlon possess a Master’s in Cybersecurity and Information Assurance from The Pennsylvania State University. Previously held high level IT Management positions at American Casino and Entertainment Properties, the Morongo Casino Resort & Spa, Harrah’s Entertainment and Aztar Corporation.
READ MORE IN THE SUMMER 2019 EDITION OF GAMING & LEISURE MAGAZINE.