All language subtitles for 011 Hashing and Digital Signatures_en

Welcome to the lecture on hashing and digital signatures, two widely used techniques in cyber security.

Let's start with hashing.

So what happens in hashing is that you provide an input or a document to a one way hashing function,

which basically generates a fixed sized message digest or a summary as the output.

Now, the key point to understand here is that you can provide a document of any size.

It can be small, it can be big, but the output size or the message digest size would remain fixed.

Another important point to understand about hashing functions is that they are one-way. So if I give you the

message digest, it is impossible for you to reverse the hash function and obtain the original document.

In fact, this property of hash functions is of critical importance.

It should be impossible to recover the original data or the original file by reversing the hash function.

Another important point to understand about hashing is that if you provide two different input documents,

it should lead to different hashes, which means that different inputs should lead to different outputs.

And if this does not happen, for example, if you provide two different types of documents or input

data and they lead to the same message digest, then we say that we have a collision and hashing functions

which cause collisions are considered poor.

A major application of hashing is in ensuring file integrity.

Let's see how this works.

So let's say you have a source with the file.

So what the source does is that it passes the file through a one-Way hash function and calculates the

hash and stores it along with the file.

Now a user goes ahead and downloads the file and its corresponding hash, and now the user recalculates

the hash of the downloaded file independently.

In the next step, the user compares the downloaded hash with the hash that it has calculated independently.

The two hashes must match.

If the two don't match, then it means that the file has been compromised and the integrity can no longer

be trusted.

Another major use of hashing is in digital signatures. So just like their counterparts, digital

signatures provide authenticity of a message, which means that if someone has digitally signed a document

or data, then they are giving the assurance that that data or file is, in fact, coming from them.

Let's see how digital signatures actually work and how they leverage hashing.

So there is a source with the file, what the source does is that it calculates the hash of the file

and then the source signs that hash using his private key.

And then this signed hash is stored along with the file.

Now, please note that this hash is not visible as plaintext.

It has been encrypted or signed with the private key of the user.

And we call it a digital signature because only the source has access to the private key and nobody

else in the world can encrypt the data using source's

private key.

So now the user downloads the file, as well as the signed hash, and the user recalculates the hash of the

downloaded file independently. Now the user also has access to the public key of the source, and he

decrypts the signed hash using the public key.

So the only way this hash could be decrypted was if this was signed by the private key of the source.

And that's why we use the public key to decrypt it.

And it worked.

So this is the basic principle of public cryptography.

Anything which is encrypted with private key can only be decrypted with the public key and vice versa.

So now the user has obtained the unencrypted or the plain text hash and he has also recalculated the

hash on his own.

So the last step, the user compares the two hashes and if the two match, then it means the digital

signature is valid and this file actually came from the sender.

However, if there is any difference, then this means either the file has changed or somebody has tried

to modify the contents of the signed hash.

In either case, the authenticity is violated and we can be sure, that this was encrypted by the source

because only private key can be used to encrypt data which is subsequently decrypted by the public.

So just like their counterparts, digital signatures provide authenticity.

What it means is that if someone digitally signed a document or data, then they are giving assurance

that this data or this file is in fact coming from them.

A digital signature is always done using the private key and the corresponding public key is distributed

to thousands of users.

So we are again leveraging the concepts of public key cryptography in which you sign using your private

key or you encrypt using your private key, and then you distribute it publicly to the public at large

and they can decrypt your message using your public key.

Confidentiality can additionally be added by encrypting the entire file, using the private key in addition

to the hash.

Some popular hashing solutions include MD5 - the message digest algorithm, which always creates

128-bit fixed sized output hashes regardless of the input.

However, in some instances, MD5 five has been shown to suffer from collisions.

What this means is that for two different inputs, it generates the same message

digest or the hash.

We also have SHA - the secure hash algorithm now SHA-1 is known to be weak, and is no longer

used.

However, for SHA-2, we have different outputs available.

We have SHA-224, 256, 384 and 512.

So these numbers represent the size of the hash output.

This concludes our lecture.

I'll see you in the next one.