Encryption and hashing

Encryption turns readable data (plaintext) into scrambled data (ciphertext) with a key, and back again with the right key. The maths is public and well tested; the key is the secret. Never invent your own encryption: use well-known methods from a trusted library.

Symmetric encryption uses the same key to lock and unlock. It's fast, so it's used for the bulk of data; AES is the standard. Its problem is sharing the key safely. Public-key (asymmetric) encryption uses a pair: a public key anyone can have, and a private key only the owner keeps. Data locked with the public key can only be opened with the private key. RSA and elliptic-curve methods are the common ones. In practice they work together: public-key maths agrees a fresh symmetric key, and the symmetric key does the rest. That's what HTTPS (TLS) does every time you load a secure page.

Encrypt data in transit (moving over a network: TLS for websites and email, SSH, VPNs) and at rest (stored: full-disk encryption on laptops and phones, encrypted databases and backups). A stolen laptop with full-disk encryption is a lost laptop, not a data breach.

A hash is a one-way fingerprint. The same input always gives the same hash, a tiny change gives a completely different one, and you can't work back from the hash to the input. SHA-256 is the common one; MD5 and SHA-1 are broken for security use.

import hashlib
print(hashlib.sha256(b"quack").hexdigest()[:16])
print(hashlib.sha256(b"Quack").hexdigest()[:16])

Sites shouldn't store your password, only a hash of it, and when you sign in they hash what you typed and compare. Each password gets a salt first, a random value stored beside the hash, so two people with the same password get different hashes and pre-computed tables of common hashes are useless. Password hashing uses deliberately slow methods (Argon2, bcrypt, scrypt or PBKDF2) so guessing is slow too. (b"..." is text as bytes, which hashing needs, and [:16] keeps the first 16 characters to save space.)

import hashlib
def hash_pw(pw, salt):
    return hashlib.pbkdf2_hmac("sha256", pw.encode(), salt, 100_000).hex()[:16]
print(hash_pw("hunter2", b"salt-for-ana"))
print(hash_pw("hunter2", b"salt-for-ben"))

A digital signature is the private key used the other way round: the owner signs a hash of a document or program, and anyone with the public key can check it came from them and wasn't changed. Software updates and website certificates are signed this way.