Gossip on Cryptography: Part 3

In this blog, we will continue our discussion from the previous blog, Parts 1 and 2. If you have not read it, please read it once.

So far, we have discussed Caesar cipher, Vigenere cipher, symmetric encryption, AES, convergent encryption, and IV. If all these terms sound familiar to you — great! If not, please go back and read Part 1 and Part 2 first.

Now, in Part 2, we ended with a teaser that in the next blog we will talk about hashing and asymmetric algorithms. So let's get into it!

First, Let's Talk About Hashing

So far, everything we discussed was about encryption and decryption — you encrypt something, and you can decrypt it back. Simple.

But what if I tell you there is a technique where you convert data into something, and you can NEVER go back to the original? Sounds weird, right? Why would someone do that?

Let me give you a real-life example.

Imagine you are the owner of a hostel. You keep a register at the gate. Every night at 10 PM, you take a photo of this register. Now, the next morning, if someone modifies the register (adds a fake entry or removes one), you can easily compare yesterday's photo with today's register and catch the change.

Hashing works exactly like this photo.

You give any data as input; the hash function produces a fixed-size string (called a hash or digest). If even ONE character in the original data changes, the hash output changes completely.

A Simple Example

Input: "Sahil"

Hash (SHA-256): 9b4c...a32f  (a 64 character string)

Input: "sahil"  (just lowercase 's')

Hash (SHA-256): 7f3a...b91e  (a completely different 64-character string!)

See? Even one small change → completely different hash. This property is called the Avalanche Effect.

Important Properties of Hashing

Let's keep it simple. A good hash function has these properties:

1. One way (Irreversible): You can go from "Sahil" → hash, but NOT from hash → "Sahil." It's a one-way street. Like making an omelet from an egg — you can't get the egg back from the omelet.
2. Deterministic: The same input will ALWAYS give the same output. "Sahil" will always produce the same hash every time.
3. Fixed size output: No matter how big your input is — whether it's one word or an entire 1000-page book — the output hash size is always the same (for SHA-256, it's always 64 characters).
4. Avalanche effect: Even a tiny change in input means a completely different hash. We just saw this above.

So, Where Is Hashing Used?

Great question! Here are the most common places:

1. Storing Passwords

This is the most common use case. When you set a password on any website, good websites never store your actual password. They store the hash of your password.

So when you log in next time:

• You type your password
• The website hashes it
• Compares it with the stored hash
• If they match → Welcome! 

This is why when you click "Forgot Password" on most websites, they reset your password instead of showing you the old one. Because they literally don't know what your old password was!

2. File Integrity Check

You download software from the internet. How do you know no one tampered with it during download? The website gives you the hash of the original file. After downloading, you calculate the hash of your downloaded file. If they match, the file is safe! 

This is used everywhere — Linux ISO downloads, software releases on GitHub, etc.

3. Digital Signatures 

We will cover this more in detail in coming parts!

Popular Hashing Algorithms

• MD5 – Old, fast, but now considered weak. Avoid using it.
• SHA-1 – Also old, mostly deprecated now.
• SHA-256 – The current gold standard. Used everywhere. (Bitcoin also uses this!)
• bcrypt/Argon2 – Special hashing algorithms designed specifically for passwords. They are intentionally slow — which makes brute force attacks harder.
• PBKDF2 (Password-Based Key Derivation Function 2) – Another password-specific algorithm. It takes your password + a salt and runs a hashing function thousands of times in a loop (this is called key stretching). The more iterations, the harder it is to brute force. It is widely used and is the recommended choice in many government and enterprise security standards (like NIST).

Wait — Can Someone Still Crack Hashes?

Yes! There are ways to try. The most common one is called a Rainbow Table Attack.

Here's how it works — imagine I am a hacker and I have pre-calculated the hashes of millions of common passwords:

• "password"  → 5f4dcc...
• "123456"    → e10adc...
• "admin"     → 21232f...

Now if I get your stored hash from a database breach, I just look it up in my table. If your hash matches any entry → I know your password!

Solution? SALT!

No, not the one you put in food 

In cryptography, a Salt is a random value that is added to your password before hashing.

Your password: "mypassword"

Random Salt:   "xK9#mQ"

Combined:      "mypasswordxK9#mQ"

Hash of this:  (some unique hash)

Now, even if two people have the same password "mypassword", because their salts are different, their stored hashes will be completely different! Rainbow Table attacks become useless. 

The salt is stored alongside the hash in the database (it's not a secret; it just needs to be unique per user).

Now Let's Talk About Asymmetric Encryption

Remember in Part 2 we discussed symmetric encryption — where the same key is used for both encryption and decryption?

The problem with symmetric encryption is — how do you share the key safely?

Imagine Rahul in Delhi wants to send an encrypted message to Priya in Mumbai. He needs to share the key with her first. But if he sends the key over the internet, a hacker can intercept the key and then decrypt all future messages. This is known as the Key Distribution Problem.

Asymmetric encryption solves this beautifully.

The Magic of Two Keys

In asymmetric encryption, instead of one key, you have two keys:

• Public key – You share this with the WHOLE WORLD. Anyone can have it.
• Private key – This stays with you ONLY. Never share it with anyone.

The magic is: Whatever is encrypted with the Public Key can ONLY be decrypted with the Private Key.

And these two keys are mathematically linked to each other.

Real Life Example — The Magic Mailbox

Think of it like a special mailbox:

• The mailbox has a slot (public key) — anyone can drop a letter in it.
• But only YOU have the key to open the mailbox (private key) — only you can read the letters.

Rahul wants to send a secret message to Priya:

1. Priya shares her Public Key with Rahul (and the whole world — no problem!)
2. Rahul uses Priya's Public Key to encrypt the message
3. The encrypted message travels over the internet — even if a hacker intercepts it, they can't read it
4. Priya uses her Private Key to decrypt the message

No need to share any secret key beforehand! The problem of key distribution is solved!

Most Popular Asymmetric Algorithm: RSA

RSA (named after its inventors Rivest, Shamir, and Adleman) is the most famous asymmetric algorithm.

It is based on a very simple mathematical observation:

It is very easy to multiply two large prime numbers. But it is extremely hard to factorize the result back into those two primes.

For example:

• Easy: 61 × 53 = 3233
• Hard: Given 3233, find the two prime factors (61 and 53)

When the numbers are hundreds of digits long, even the fastest computers in the world would take millions of years to crack it. That's the security of RSA!

RSA key sizes you will commonly see: 1024-bit (old, avoid), 2048-bit (current standard), 4096-bit (extra secure).

Symmetric vs. Asymmetric — When to Use What?

In the real world, both are actually used together! The typical flow is:

1. Use asymmetric encryption to securely exchange a secret key
2. Then use symmetric (AES) encryption for the actual data — because it's much faster

This combo is how HTTPS (the secure web) actually works! When you open any https:// website, this exact thing is happening in the background. That little lock you see in your browser? That's this.

Terms We Have Learned So Far (Including Parts 1 & 2)

• Cryptography
• Algorithm
• Plain text
• Key
• Cipher text
• Symmetric encryption
• Convergent encryption
• Initialization vector (IV)
• Hashing
• Hash/Digest
• Avalanche effect
• Salt
• Rainbow table attack
• Asymmetric encryption
• Public key
• Private key
• RSA

Please keep them in mind, as these are the generic terms used everywhere in the world of encryption and decryption.

Coming in Part 4 

(Part 4 is in progress — stay tuned!)

In the next blog, we will gossip about some very interesting things like:

• Digital signatures – How do you prove that a message is really from who it claims to be from?
• PKI infrastructure – The backbone of trust on the internet
• SSL/TLS – What actually happens when you open an HTTPS website, step by step
• Envelope encryption – A very clever technique used by cloud providers like AWS and GCP
• And more...

Stay tuned for Part 4!

If you liked this blog, do give it a like and share it with someone who you think should learn this. Let's spread the knowledge!

Read the previous parts here: Part 1 and Part 2.