Hashing Algorithms for Storing Sensitive Data

Posted on October 17, 2018 by Administrator Posted in A Level Concepts, Algorithms, Computer Science, Computing Concepts, Cryptography

More and more online systems such as e-commerce websites, online banking apps, or social networks need to access some sensitive data about you including your password, your credit card details and more recently, some biometric data (e.g. for fingerprint authentication process).

The servers that store your personal data are at risk of being hacked and though the organisations who run these online services invest a lot of money in ensuring their servers are secure (firewalls, encryption of data, etc.) there is always a risk of a hacker accessing the data stored on their servers. This is why organisations prefer not to store very sensitive data directly (passwords, credit card numbers and biometric data). Instead these organisation use complex hashing algorithms to store hash values of your most sensitive data.

Hashing Algorithm

A hashing algorithm is a complex mathematical calculation that takes an input called the key (e.g. your credit card number or your password) to generate a hash value. The hash value often consists of a string of characters of a fixed size (e.g. 32 alpha-numeric characters).

The hashing algorithm will always produce the same hash for a given key. The hash value will be fairly unique (different for each key, though on rare occasions two different keys can produce the same hash, this is called a collision).

When a user enter their password, for instance to login, the same hashing algorithm is used to recreate the hash value. This hash value can then be compared to the hash stored on the server for this user. If they are the same we can assume that the password entered by the user is correct.

This works exactly the same with credit card numbers. When asked to pay online, the user enters their credit card number. The hashing algorithm is applied to the key (credit card number) to produce a hash value which can be compared with the hash value stored on the system for that user. If the two hash values are identical, we can assume that the credit card number entered is correct.

A one-way process

Hash functions are one-way functions which means that with the key you can calculate the hash value, however with a hash value you cannot determine the key.

This is an essential characteristic of hashing algorithms which ensures that even if a hacker manages to access the organisation’s database, they will not be able to easily work out your password or credit card numbers from the hash values stored on the database.