Hi, everyone, and welcome back to the Knowledge Portal Video series.
This is Zeal.
And in today's topic, we'll be talking about hashing.
Hashing is one of the very, very important functions that is available.
And as an information security person, hashing is one of the things that will be always useful throughout
your life.
So let's see what hashing does.
So here we have a sample document.
So let's consider this as a notepad file.
And inside a notepad file there is a text called as Secret Text.
Now, once we pass this notepad file to a hashing algorithm.
Hashing algorithm will generate a unique output.
Now, this output depends upon the text which is written inside the file.
So here, if we see it is secret.
Secret text.
Now let's look into another example.
Where we have changed the contents.
So instead of secret text, we have written secret text one.
So there is one number that is added to the file.
We pass that file to the hashing algorithm and we get a output.
Now compare this output with starts from a 71 ends with D six to the original output, which starts
from 64 and ends with F.
So here you see even changing one character or one number of a file.
The whole output of the file changes once you pass it over to the hashing algorithm.
So what does hashing algorithm does?
Well, hashing algorithm will tell us if the file is modified or not.
So if we talk about viruses.
Viruses basically attach to the files and they change the structure of the file.
So it is through the help of hashing algorithm.
It is possible for us to know whether a file is modified or not.
So before we go into this slide, I'll give you a small demonstration on how hashing works.
I'll minimize the.
And.
Yeah.
And maximize the skill.
So here, if we see this is my Kali Linux machine, which I'm connected to putty.
So it is running on the background in my virtual machine.
So here there is one document, there is a text file called as Document.
And if I do a cat, I'll see the contents of the file.
So the content of the file is secret space text.
Now let me find the MD5 sum of this.
Documents.
I'll run MD5 sum.
This will give me the hash value and followed by the name of the file which is document.
So here it gave me some.
Hashed value of the document.
Now.
Let me open the document and let me add a full stop over here.
Right.
And I'll save it.
So now we have modified the file.
Let me again take the hash value.
And if you compare this hash.
With the below hash, you can easily identify that the file is changed.
Right.
So hashing helps us to identify whether a file is modified or not.
So if you look into a production environment, generally files would not be modified.
So in production environment for all the important files, there is a program which monitors whether
the file is changed or not, and if the file is changed, the program will immediately email to the
system administrator saying this file is modified.
So.
Coming back to the presentation.
Now, if we compare if we ask what is the difference between an encryption and a hashing?
So basically encryption is a two way function.
So what does two way function mean?
So here you see first, this is a plaintext data knowledge portal.
We encrypt it and we got some encrypted value.
Now, by applying the key on a decryption algorithm, we are getting the plaintext back.
So here we are applying key ones on the encryption side and applying key second time on the decryption
side.
So.
If we have this encrypted value, we can always recover the plaintext from this encrypted value by applying
the key.
But hashing does not work this way.
Hashing is a one way function.
So that means if this is a document.
And you pass it to the hashing algorithm.
Then you get this output value.
Now, from this output value, you will not be able to recover the document back.
Now you will ask then what is the use of hashing function?
So let's explore on what could be the benefits of this kind of a.
The.
First benefit is your system files do not change.
If it has changed, then there is a high probability that a virus has done it right.
Most of the system files will not change any time, only and only if some person is manually changing
the file, which is highly unlikely, or if a virus is doing it.
So in a production environment all the time, there is a file integrity monitoring software that runs
which will email us as soon as some file is modified.
And how it knows if the file is modified.
It compares the hash.
Now, the second use of hashing is you can store your password in a hash value instead of an encrypted
value.
So let's go to one note and understand this.
I lose my favorite pen and I go back to the full screen.
So.
So whenever you log in to, let's say, Windows Machine, it will ask you for a.
User and it will ask you for a password.
This is a Windows box.
So in order to login, it will ask you for your username and it will ask you for a password.
Now how will Windows verify that the credentials that you have supplied are correct or not?
Well, certainly it would have some file.
Right.
Where?
It would check that if this username and password is right.
So there has to be a file where the username and password must be stored.
So whenever you type username password, your Windows operating system will verify it from the file.
If it is correct.
Then you will be granted access.
Now let's explore about this file a bit.
Let's say your username and password is stored in plain text data.
Right?
So if my username is Z.
And password is Motorola.
So if the plaintext username and password is stored over here, that means any person can open this
file in notepad and can see the contents of it.
Right.
So we were discussing this is why encryption is used so that even if the person gets hold of the data,
he will not be able to read the data.
Right.
So there can be two scenarios which can be used over here.
The first scenario is encryption.
And the second scenario is hashing.
Let's look at the first scenario first.
So if we are using encryption, that means that your windows has to store some secret key somewhere
in the file.
Right?
So secret key has to be stored somewhere so that windows can actually decrypt the file and can see the
contents of it.
Now, what happens if the secret key gets leaked?
All the username and passwords are leaked, right?
So this is not a very, I would say, optimal way.
Second way is hashing.
So what happens in hashing is.
Your windows.
Will take a hash value of this Motorola.
Right.
And it will have some hash value.
C Phi 2N1.
This is some random value, right?
And it will store username as well as hash value in the.
System five.
So if I open the system file, it would be something, say, Z.
Zeal followed by the hash value C, five, two and one.
So let's say hackers gets access to the system file and they are able to read zeal followed by this.
Now, as we have seen, hashing is a one way function.
So from this value.
So from this hash value, we cannot recover the password back.
It is not a two way function, it is only a one way function.
So even if the hacker sees this file, he will not be able to find the password.
So this is the reason why hashing is used in almost all the operating system to store the password.
So let me show you one of the example.
So in Linux, the passwords are stored in shadow.
So let's open e.t.c. shadow.
So here you see first is the username.
The username is root followed by.
The hashed value of the password.
So this is not an encrypted data.
This is the hash value.
So hash means one way function.
So from this we cannot recover the original data back.
So now the point is, how will the system know that this password, the password that you write, matches
the password which is there in your system.
So what system does is whenever you log in with username and password, say Motorola.
Your system will first take the hashed value of this password.
It will hash this password and it will get some hashed value.
It will compare this hash value with a hash which is stored in your system file.
And if the two hash matches and also if the username matches.
It will grant you access.
So here if I type moto rollout.
Rule one.
That means your system will first take a hash value.
Now, as we have added one at the end, the hash will completely change, right?
This is the hash.
It will compare hash with the hash in the system file.
And now, as the hash does not match, that means.
The password is wrong and this is how your system verifies it.
Now.
There is one more use of hashing.
Let's see how it is used.
I erase everything.
And.
Okay.
Let me create a new document and let's view it in the full screen.
So.
So let's say this is the second use of hashing.
So let's say this is a server.
And this is your.
Laptop.
This server contains a lot of softwares.
And this is the Internet.
So.
Whoops.
Uh.
So as this is the Internet, that means.
There'll always be a hacker somewhere.
Okay, so let's say you are downloading.
This is a Microsoft office.
Okay, You're downloading Microsoft office from this server to your computer.
Now, this file will come.
Through the network.
To your computer.
Now there can be a possibility.
Where?
Hacker.
Would maybe say block this file and insert his virus version of Microsoft Office.
It is always possible, right?
You never know because this server might be in us and your.
Laptop might be in India.
So there is a very big communication channel between these two countries.
So how will you make sure that your software that you have downloaded is the exact version which is
there from the server?
The thing that is used is MD5, not MD5 hashing.
So what happens is whenever you download a software from a server, they generally give a hash value
along with the software.
So this is our Microsoft office and along with the Microsoft office, they'll give you.
A hash value.
So once you download the Microsoft office from the server to your laptop, now your job is to take a
hash value of this.
Say this is a hash value that you get.
And compare it compare it with the hash value which the Microsoft has provided.
Now, if the hash value are same, that means you have downloaded the correct version.
Now, if the hash value is different, there can be two possibilities.
One is that your software is not downloaded correctly.
Some portion of the software must have been corrupted.
That is one possibility.
Second possibility is.
From the network.
There has been some modification that has been done to the file.
So there can be two possibilities for that.
So always check for a hash value when you're downloading the software.
Nowadays, most of the companies who are providing softwares online, they give the hash value on their
website when you try to download the software.
Coming back to the slides.
So the third point that was we discussed was verify the integrity of the software that you download.
So this is all about hashing.
Try to make a file, try to hash it, modify the file.
See the hash value.
See if you are getting some different hash value.
And.
This is all about hashing, so I hope you have enjoyed this lecture.
And in the next module we'll be talking about viruses and it is going to be very interesting.
So thanks for watching.
Have a nice day.