When logging into your social media account or online banking app, the gate pass is your password, which typically consists of a string of letters, numbers, and symbols to make it a stronger password. This password grants you access to your personal information and savings. Here's how it works: when you tap "login" after inputting your password, the door opens if the password is correct, and remains closed if it is wrong.
Now, here's the big question: does the system store your password in its database to confirm the authenticity of any login? And if hackers gain access to the database, would your password be exposed and stolen?
In this article, we'll uncover what happens behind the scenes when you enter your password and all processes involved from registration of passwords to confirmation of authenticity when you attempt to login.
HOW PASSWORD WORKS
When you sign up on a website or platform, a lot of activities happen in the backend to ensure your password is safe and secured. Here's what happens during registration: when you input your username and password in plain text, your password is hashed and stored in the website's database using a hashing algorithm. A hash is a scrambled code that appears as a string of letters and numbers. It's a one-way function, meaning that once a password is hashed, it cannot be reverse back to your original password.
After signing up, when you log in again using your same username and password, the system immediately hashes your password within seconds using the same algorithm. It then compares this newly generated hash with the one stored in the website's database. If the two match, it signals that the password is correct, and access is granted. If they don't match, it signals that the password is wrong, and access is denied.
Your hash password cannot be used to log in directly to your account; it will return an incorrect password error. This means your original password is known only to you, not even the website or the system knows it.
Even if hackers gain access to the website's database, all they would see is your scrambled hash code.
WHAT IS HASHING
Hashing is the process of converting data (text, numbers, files, etc.) of any size into a fixed-length string of characters using a special mathematical function called a hash function.
Hashing and encryption serve different purposes. The key difference is that hashing is a one-way function, while encryption is a two-way function, meaning encrypted data can be unlocked (decrypted) once scrambled using the correct key. Encryption is used to protect sensitive information so that only authorized recipient with the key can decrypt to access it.
In the case of hashing, it is irreversible. Once data is hashed, it cannot return to its original form.
For hashing to be effective, the following terminologies are involved;
HASH FUNCTION
A hash function s a mathematical algorithm that converts input into a hash value by simply dividing the input data into data block and processing them. The key concept is that the hash value must be unique to the exact input.
A situation whereby the hash function produces the same hash value for two different input data, it is known as hash collision. This situation is not a positive result, as it compromises the readability and usefulness of the hashing algorithm..
EXAMPLES OF HASH FUNCTION
MD5 ALGORITHM
MD5 stands for Message Digest 5. It is a cryptographic hash function that generates a 16 bytes (128- bit) hash value. Before the hash value is produced, the input data is divided into 512-bit blocks, with each block processed in four rounds of 16 operations. The final values of the four variables are combined to produce the 16 bytes hash value.
SHA
SHA stands for Secure Hash Algorithm. It is one of the most trusted and widely used cryptographic hashing system in the world, developed by the U.S. National Security Agency (NSA).
The first major version was SHA-1, it produces 160-bit hash value. However, it is no longer considered secured due to vulnerability to collision attack.
Its improved version, SHA-2, an advanced successor of SHA-1, offers stronger security and comes in several varients, including SHA-224, SHA-256, SHA-384, and SHA-512. They differ in size of the output hash and internal structure.
SHA-3 is the latest version of the Secure Hash Algorithm family. It is built on a completely different cryptographic foundation known as the Keccak algorithm, unlike the design of SHA-1 or SHA-2. It offers a higher level of security and resistance to collision attacks.
It was standardized by NIST (National Institute of Standards and Technology) in 2015 to serve as an alternative to SHA-2.
CRC32
CRC32 Stands for Cyclic Redundancy Check 32. It is not used for handling the security or authenticity of passwords; instead, it is designed to detects accidental data corruption during transmission.
It performs check on block of data and return a fixed-length checksum that is unique to the input data. This checksum makes it possible to verify whether the data has been changed, corrupted or damaged during transmission or storage