Cryptographic Hashes Explained: SHA-256 vs. SHA-512 vs. MD5 and Collision Resistance

What is a Cryptographic Hash Function?#

Unlike encryption algorithms (such as AES or RSA) which are two-way and designed to be decrypted with a secret key, a cryptographic hash is a strictly **one-way function**. Given the hash output `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855`, it is mathematically impossible to reverse-engineer the original input without brute force.

The Five Mandatory Properties of Secure Hashes#

To be classified as cryptographically secure by NIST, an algorithm must satisfy five criteria:

• 1. Deterministic: The exact same input message will always produce the exact same output hash.
• 2. Fast Computation: The hash of any message can be calculated quickly in software or hardware.
• 3. Pre-image Resistance (One-Way): Given a hash $h$, it is computationally infeasible to find message $m$ such that $\text{hash}(m) = h$.
• 4. Small Change Avalanche: Modifying even a single bit of the input dramatically changes the output.
• 5. Collision Resistance: It must be virtually impossible to find any two different messages $m_1$ and $m_2$ that produce the identical hash $\text{hash}(m_1) = \text{hash}(m_2)$.

The Avalanche Effect in Action#

The avalanche effect ensures that attackers cannot perform gradient analysis or guess patterns in the input. Notice how changing a single letter from lowercase to uppercase alters the entire 256-bit hexadecimal output:

• Input: `softnag` → Hash: `0810db303f269a84a60ea54e389e023c914e6629910d655f41cbfaad01bb610f`

• Input: `Softnag` → Hash: `65a045761a29aa705a6bb9a4cbdfaa43451cb9922e379b18365287f3b89ce321`

Why MD5 and SHA-1 Are Broken: Collision Attacks#

In 2004, cryptographers led by Xiaoyun Wang demonstrated practical collision attacks against **MD5** (128-bit). By 2017, Google announced the **SHAttered** attack, producing two distinct PDF documents with identical SHA-1 hashes.

Today, MD5 and SHA-1 must NEVER be used for digital signatures, SSL certificates, or password verification. They are only acceptable for non-cryptographic checksum verification.

How SHA-256 Works: 64 Rounds of Bitwise Logic#

Designed by the NSA and published by NIST in 2002 under the SHA-2 family, SHA-256 processes 512-bit message blocks through 64 iterative rounds of modular addition, bitwise rotations (`ROTR`), and logical choice functions (`Ch` and `Maj`).

The total number of possible SHA-256 hashes is $2^{256} \approx 1.1579 \times 10^{77}$, an astronomical quantity exceeding the estimated number of atoms in the observable universe.