Hashing vs Encryption - OWASP Top 10

1. Introduction

In the realm of cybersecurity, understanding the difference between hashing and encryption is crucial. Both are cryptographic techniques used to protect sensitive data, but they serve different purposes.

2. Hashing

Common Hashing Algorithms

• MD5
• SHA-1
• SHA-256
• SHA-3

Code Example

import hashlib

# Hashing a password
password = "mysecretpassword"
hashed_password = hashlib.sha256(password.encode()).hexdigest()
print("Hashed Password:", hashed_password)
                

3. Encryption

Common Encryption Algorithms

• AES (Advanced Encryption Standard)
• RSA (Rivest-Shamir-Adleman)
• DES (Data Encryption Standard)

Code Example

from Crypto.Cipher import AES
import os

# Encryption
key = os.urandom(16)  # AES key
cipher = AES.new(key, AES.MODE_EAX)
nonce = cipher.nonce
plaintext = b"Secret Message"
ciphertext, tag = cipher.encrypt_and_digest(plaintext)

print("Ciphertext:", ciphertext)
                

4. Key Differences Between Hashing and Encryption

1. Purpose: Hashing is used for data integrity, while encryption is used for data confidentiality.
2. Reversibility: Hashing is irreversible; encryption can be reversed with the correct key.
3. Output Size: Hashing produces a fixed-size output; encryption's output size depends on input size.
4. Use Cases: Hashing is used for password storage; encryption is used for secure data transmission.

5. Best Practices

• Use strong, well-established algorithms (e.g., SHA-256 for hashing, AES for encryption).
• Implement salting with hashes to prevent rainbow table attacks.
• Store encryption keys securely and separate from encrypted data.
• Regularly update and patch cryptographic libraries.

6. FAQ