Difference between Hashing a Password and Encrypting it

by

Hashing is a one way function (well, a mapping). It’s irreversible, you apply the secure hash algorithm and you cannot get the original string back. The most you can do is to generate what’s called “a collision”, that is, finding a different string that provides the same hash. Cryptographically secure hash algorithms are designed to prevent the occurrence of collisions. You can attack a secure hash by the use of a rainbow table, which you can counteract by applying a salt to the hash before storing it.

Encrypting is a proper (two way) function. It’s reversible, you can decrypt the mangled string to get original string if you have the key.

The unsafe functionality it’s referring to is that if you encrypt the passwords, your application has the key stored somewhere and an attacker who gets access to your database (and/or code) can get the original passwords by getting both the key and the encrypted text, whereas with a hash it’s impossible.

People usually say that if a cracker owns your database or your code he doesn’t need a password, thus the difference is moot. This is naïve, because you still have the duty to protect your users’ passwords, mainly because most of them do use the same password over and over again, exposing them to a greater risk by leaking their passwords.

More Related Contents:

  1. SHA512 vs. Blowfish and Bcrypt [closed]
  2. What algorithm should I use to hash passwords into my database? [duplicate]
  3. Fundamental difference between Hashing and Encryption algorithms
  4. Is “double hashing” a password less secure than just hashing it once?
  5. Encrypting/Hashing plain text passwords in database [closed]
  6. The necessity of hiding the salt for a hash
  7. Password hashing, salt and storage of hashed values
  8. Best Practices: Salting & peppering passwords?
  9. Why not use MD5 for password hashing?
  10. Should I impose a maximum length on passwords?
  11. Do I need a “random salt” once per password or only once per database?
  12. Two-way encryption: I need to store passwords that can be retrieved
  13. How to hash a password
  14. How can bcrypt have built-in salts?
  15. Non-random salt for password hashes
  16. Are HTTPS headers encrypted?
  17. Where do you store your salt strings?
  18. Why is using a Non-Random IV with CBC Mode a vulnerability?
  19. encrypt and decrypt md5
  20. What is the purpose of base 64 encoding and why it used in HTTP Basic Authentication?
  21. Differences Between Rijndael and AES
  22. How to send password securely over HTTP?
  23. Moving old passwords to new hashing algorithm?
  24. Best way for a ‘forgot password’ implementation? [closed]
  25. Why do salts make dictionary attacks ‘impossible’?
  26. How do I generate a SALT in Java for Salted-Hash?
  27. Is it worth encrypting email addresses in the database?
  28. MD5 security is fine? [closed]
  29. How can I hash passwords in postgresql?
  30. How to send password securely via HTTP using Javascript in absence of HTTPS?

Leave a Comment