Encryption is a fundamental aspect of modern cybersecurity. It protects sensitive data in transit and at rest, ensuring that only authorised parties can access it.
Whether you’re logging into a website, making an online payment, or storing passwords securely, encryption and hashing are constantly working behind the scenes.
This article explains how encryption works, the difference between encryption and hashing, why older algorithms such as MD5 and SHA-1 are considered broken, and how modern alternatives improve security.
What Is Encryption?
Encryption is the process of converting readable data (known as plaintext) into an unreadable format (ciphertext). This is done using a mathematical algorithm and a cryptographic key.
Only someone with the correct key can decrypt the ciphertext and recover the original data.
A simple workflow looks like this:
Plaintext → Encryption Algorithm + Key → Ciphertext
Ciphertext → Decryption Algorithm + Key → Plaintext
In web hosting, encryption is commonly used for secure communications (HTTPS), disk encryption, secure messaging and protecting stored files.
Modern encryption algorithms include:
- AES (Advanced Encryption Standard) – commonly used for file and disk encryption
- RSA (Rivest-Shamir-Adleman) – a public key algorithm commonly used for digital signatures and certificate authentication.
- ECC (Elliptic Curve Cryptography) – a family of public key techniques used for key agreement and digital signatures, offering strong security with relatively small keys.
Symmetric and Asymmetric Encryption Explained
There are two main types of encryption used today: symmetric encryption and asymmetric encryption. Both protect sensitive information, but they work in different ways and are often used together to provide strong security.
Symmetric Encryption
Symmetric encryption uses the same shared secret key to encrypt and decrypt data. This makes it extremely fast and efficient, which is why it is commonly used for encrypting large amounts of data, such as website traffic, files, and database information.
Both parties need access to the same private key, meaning the key must be shared securely before encrypted communication can begin.
If an attacker intercepts this key, they could decrypt the protected data.
Asymmetric Encryption
Asymmetric encryption solves this key distribution challenge by using a pair of keys: a public key and a private key. Depending on the algorithm, the key pair can be used for authentication, digital signatures, encryption or establishing shared session keys.
The public key can be freely shared and is used to encrypt data, while the private key remains securely stored and is used to decrypt that data. The private key is never shared, which results in a safer method for exchanging encryption keys and verifying identities online.
The trade-off is that asymmetric encryption requires more processing power and is slower than symmetric encryption.
TLS at 20i
Websites covered by a TLS certificate use both symmetric and asymmetric encryption through TLS (Transport Layer Security), which replaced the older SSL (Secure Sockets Layer) protocol.
During the TLS handshake, the browser and server negotiate cryptographic parameters, establish shared session keys and authenticate the server using its certificate. The connection then uses fast symmetric authenticated encryption to protect application data.
Speed and security are our priorities at 20i, so we also utilise OCSP stapling through our CDN.
Instead of the client’s browser querying the CA (Certification Authority) to check the certificate each time, our web servers periodically request a signed OCSP response from the CA which is then ‘stapled’ to the TLS handshake process.
Hashing vs Encryption
Although often confused, hashing and encryption serve very different purposes.
A hash function takes an input of any size and produces a fixed-length string known as a digest.
Example:
Input: hello123
SHA-256 hash:
27cc6994fc1c01ce6659c6bddca9b69c4c6a9418065e612c69d110b3f7b11f8a
Even a tiny change in the input drastically changes the hash output. This is known as the avalanche effect.
For example:
hello123
6ca13d52…
hello124
0adab7ae…
Cryptographic hashes are designed to be computationally impractical to reverse. However, weak passwords can still be recovered through guessing attacks, which is why passwords must be processed using a dedicated password hashing function.
Instead of storing a password, systems store its hash. When a user logs in, the entered password is hashed and compared to the stored value.
Legacy Hashing Algorithms: MD5 and SHA-1
Early cryptographic systems used algorithms such as MD5 and SHA-1, which were widely used for file integrity checks and password hashing.
MD5
- Digest length: 128 bits
- Created in: 1991
- Output length: 32 hex characters
Example:
MD5(“password123”)
482c811da5d5b4bc6d497ffa98491e38
SHA-1
SHA-1 was developed by the National Security Agency and released in 1995.
- Digest length: 160 bits
- Output length: 40 hex characters
Example:
SHA-1(“password123”)
cbfdac6008f9cab4083784cbd1874f76618d2a97
The Problems
MD5 and SHA-1 have serious collision weaknesses, making them unsuitable for digital signatures, certificates and other uses that depend on collision resistance. They are also unsuitable for password storage because they are extremely fast and lack built in password hardening.
These vulnerabilities were demonstrated in the MD5 Collision Attack and SHAttered Attack, making them unsuitable for security purposes.
Modern Hashing Algorithms
Modern systems use a mix of cryptographic hash functions and password hashing algorithms, depending on the use case.
Common examples include SHA-256, SHA-512, and bcrypt but they serve very different purposes.
SHA-256
- Digest length: 256 bits
- Output length: 64 hexadecimal characters
Example:
SHA-256(“password123”)
ef92b778bafe771e89245b89ecbc08a44a4e166c06659911881f383d4473e94f
SHA-256 is a general-purpose cryptographic hash function. It is designed for speed and consistency, making it suitable for verifying data integrity, digital signatures, and cryptographic systems.
However, it’s not suitable for storing passwords, as it is too fast and can be attacked efficiently through brute force guessing
SHA-512
- Digest length: 512 bits
- Output length: 128 hexadecimal characters
Example:
SHA-512(“password123”)
bed4efa1d4fdbd954bd3705d6a2a78270ec9a52ecfbfb010c61862af5c76af1761ffeb1aef6aca1bf5d02b3781aa854fabd2b69c790de74e17ecfec3cb6ac4bf
SHA-512 is part of the same SHA-2 family and serves the same general-purpose role as SHA-256, but with a larger output size and different performance characteristics.
It is commonly used in systems where strong hashing and high throughput are required, but again, it is not a password hashing algorithm.
bcrypt
bcrypt is an adaptive password hashing function. It incorporates a salt and configurable work factor, allowing applications to increase the computational cost of each password guess.
Unlike SHA-2 functions, bcrypt is intentionally slow, uses a configurable cost factor to increase computation time and includes a built-in salt to protect against rainbow table attacks.
It is widely used in authentication systems, including WordPress setups and many web applications.
How Bit Length Affects Security
The bit length of a hash determines how many possible outputs exist.
Each additional bit doubles the number of possibilities, making it less likely for collisions and extremely difficult to crack.
A larger digest increases the number of possible outputs. For an ideal 256 bit hash, finding a specific preimage requires approximately 2²⁵⁶ operations, while finding any collision requires approximately 2¹²⁸ operations.
The birthday bound explains why collision resistance is lower than the total number of possible hash outputs might suggest. Due to the birthday paradox, finding any two inputs that produce the same hash requires approximately the square root of the possible hash space, meaning an n-bit hash provides roughly n/2 bits of security against collision attacks.
For example, a 256-bit hash has 2²⁵⁶ possible outputs, but a collision can theoretically be found in around 2¹²⁸ attempts. This does not compromise the security of modern hash functions such as SHA-256, but it is an important consideration when selecting an appropriate algorithm for long-term security.
How Long Would It Take to Crack?
For password cracking, the actual time depends on the hardware being used (e.g. GPUs or ASICs), whether the attacker is guessing from a dictionary or brute-forcing and the strength of the password.
For the hash algorithms themselves, assuming an attacker is trying to perform a pure brute-force cryptographic attack against the hash function, we can make some rough estimates.
Let’s assume an incredibly powerful attacker capable of computing ~10¹⁵ (1 quadrillion) hashes per second:
Attackers rarely brute force blindly. Instead, they use other password attacks to maximise success and minimise the time taken.
This is where salting becomes essential.
What is Salting?
A salt is a random value added to a password before hashing.
Instead of hashing password123, the system hashes password123 + randomSalt
Example:
password123 + 7Xf2!a9
Result:
SHA-256(password1237Xf2!a9)
Salting greatly reduces the effectiveness of Rainbow Table Attacks as attackers cannot pre-compute hashes due to each password being hashed with a unique salt. They must repeat the guessing process separately for each salt.
Salting also prevents Identical Hashes as two users with the same password will still produce different hashes.
Example:
User A
password123 + saltA → hashA
User B
password123 + saltB → hashB
This makes large-scale password cracking significantly harder.
What Does This Mean for Security?
Older hashing algorithms like MD5 and SHA-1 are considered insecure because modern computing power can exploit weaknesses in their design.
Modern security systems rely on larger bit lengths, collision resistance, salting, and key stretching algorithms such as bcrypt or Argon2.
These improvements dramatically increase the computational effort required for attackers to crack stored data.
Summary
Encryption and hashing are essential tools in cyber security, but they serve different purposes.
Encryption ensures data confidentiality, allowing authorised users to decrypt information using a key. Hashing, on the other hand, ensures data integrity and secure password storage through irreversible mathematical transformations.
Legacy algorithms like MD5 and SHA-1 were once widely trusted but are now considered broken due to collision vulnerabilities. Modern alternatives such as SHA-256 and SHA-512 offer significantly stronger security through larger bit sizes and improved resistance to cryptographic attacks.
Combined with techniques like salting, modern hashing systems make brute-force password cracking impractical, helping protect sensitive data in both business and personal settings.
