General Security Concepts · Topic 6 of 7
Hashing, Signatures and Obfuscation
Learn hashing, salting, key stretching, digital signatures, blockchain, steganography, tokenization and masking, and which goal each one supports.
- 4 min
- A hash is one way and fixed length. It supports integrity, not confidentiality.
- MD5 and SHA-1 are weak. SHA-256 is a current choice.
- Salting defeats rainbow tables. Key stretching slows brute force guessing.
What it is
This page covers cryptographic tools that protect integrity and identity, and methods that hide data without full encryption.
Hashing turns any input into a fixed length value called a digest. A digital signature proves who sent a message and that it was not changed. Obfuscation hides or replaces data so that it is harder to read or use.
How it works
Hashing
A hash function is one way: you cannot work backward from the digest to the message. A good hash always gives the same digest for the same input, and a tiny change gives a very different digest.
| Algorithm | Status |
|---|---|
| Message Digest 5 (MD5) | Broken for collisions, avoid for security |
| Secure Hash Algorithm 1 (SHA-1) | Deprecated |
| SHA-256 and other SHA-2 variants | Current and widely used |
A collision happens when two different inputs give the same digest. Hashes are used to check file integrity and to store passwords. A hash based message authentication code (HMAC) mixes in a secret key, so it proves integrity and that the sender knew the key.
Salting and key stretching
If passwords are stored as plain hashes, an attacker can use a precomputed list called a rainbow table. Salting adds a unique random value to each password before hashing, so identical passwords give different digests and precomputed tables stop working.
Key stretching makes each guess slower by repeating the hash many times. Common examples are Password Based Key Derivation Function 2 (PBKDF2) and bcrypt. A slow hash is good for passwords because it makes brute force guessing expensive.
Digital signatures
A signature uses the sender's key pair in the opposite direction from encryption. The sender hashes the message and signs the digest with the private key. Anyone can check it with the public key.
A valid signature shows integrity, authentication of the sender and non-repudiation. It does not hide the message, so signed data is still readable unless it is also encrypted.
Blockchain
A blockchain is a shared, append only ledger. Each block contains a hash of the previous block, so changing an old record breaks every later link. Copies are kept by many participants, which makes the ledger resistant to tampering and removes the need for one trusted record keeper.
Obfuscation methods
| Method | What it does |
|---|---|
| Steganography | Hides data inside another file, such as an image |
| Tokenization | Replaces sensitive data with a random token and keeps the real value in a separate secure store |
| Data masking | Hides part of a value, such as showing only the last four digits of a card |
Tokenization and masking are common in payment and customer data. Steganography hides the existence of the message, while encryption hides its content.
Limitations to keep in mind
Cryptography has practical limits. Strong algorithms can be undone by poor key handling, predictable random values (low entropy), reuse of keys, or long term weakness as computers become faster. Low power devices may not have the speed to use heavy algorithms.
What to remember for the exam
- A hash is one way and fixed length. It supports integrity, not confidentiality.
- MD5 and SHA-1 are weak. SHA-256 is a current choice.
- Salting defeats rainbow tables. Key stretching slows brute force guessing.
- PBKDF2 and bcrypt are key stretching functions.
- A digital signature gives integrity, authentication and non-repudiation. It is made with the private key and checked with the public key.
- HMAC uses a shared secret with a hash to prove integrity and sender knowledge.
- Blockchain links blocks by hash and is spread across many copies.
- Tokenization replaces data with a token. Masking hides part of a value. Steganography hides data inside another file.
If the question asks how to prove a file has not changed, think hash. If it asks how to prove who created it, think digital signature.
Common mistakes
Calling hashing encryption. Encryption can be reversed with a key. A hash cannot be reversed.
Skipping the salt. Without a unique salt, two users with the same password have the same stored value, which helps an attacker.
Signing with the public key. The private key signs and the public key verifies. The reverse use is for confidentiality.
Thinking a signature encrypts the message. It protects authenticity and integrity only.
Treating masking and tokenization as the same. A masked value is a partly hidden form of the data. A token has no mathematical link to the original and depends on a lookup store.
A fast hash is good for file checks and a poor choice for storing passwords. Use a salted, slow method for passwords.
Check yourself
What does a salt prevent?
It prevents precomputed rainbow table attacks and makes identical passwords give different stored hashes.
Which key creates a digital signature?
The sender's private key. The receiver verifies it with the sender's public key.
How is tokenization different from data masking?
Tokenization swaps the data for a random token with the real value stored elsewhere, while masking only hides part of the value.
Topic 6 of 7 in General Security Concepts
Test yourself on General Security Concepts
The full CompTIA Security+ SY0-701 question bank has 848 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.