General Security Concepts · Topic 7 of 7
Hashing, Signatures and Obfuscation
Learn hashing algorithms, salting, digital signatures, steganography, tokenization and data masking, and which security goal each one supports.
- 5 min
- A hash is one way and fixed length. It supports integrity, not confidentiality.
- MD5 and SHA-1 are weak. SHA-256 and SHA-3 are current choices.
- HMAC uses a shared secret with a hash to prove integrity and sender knowledge.
What it is
This page covers cryptographic tools that protect integrity and identity, and methods that hide data without full encryption.
Hashing turns any input into a fixed length value called a digest. A salt makes stored password hashes harder to crack. A digital signature proves who sent a message and that it was not changed, and obfuscation hides or replaces data so that it is harder to read or use.
How it works
Hashing algorithms
A hash function is one way: you cannot work backward from the digest to the message. A good hash always gives the same digest for the same input, and a tiny change gives a very different digest.
| Algorithm | Digest size | Status |
|---|---|---|
| Message Digest 5 (MD5) | 128 bits | Broken for collisions, avoid for security |
| Secure Hash Algorithm 1 (SHA-1) | 160 bits | Deprecated |
| SHA-2 family, such as SHA-256 and SHA-512 | 224 to 512 bits | Current and widely used |
| SHA-3 family | Several sizes | Current, a newer design than SHA-2 |
A collision happens when two different inputs give the same digest. Once collisions can be produced on demand, an attacker can swap a file without changing its hash, so the algorithm is no longer safe for integrity checks.
Hashes are used to check file integrity, to support digital signatures and to store passwords. A hash based message authentication code (HMAC) mixes a secret key into the hash, so it proves integrity and that the sender knew the key.
Salting
If passwords are stored as plain hashes, an attacker can use a precomputed list of hashes called a rainbow table. Two users with the same password would also have the same stored hash.
Salting adds a unique random value to each password before hashing. Identical passwords then give different digests, and precomputed tables stop working.
The salt is not secret. It is stored next to the hash, because the system needs it to check the password at the next sign in.
Digital signatures
A signature uses the sender's key pair in the opposite direction from encryption. The sender hashes the message and signs the digest with the private key. Anyone can check it with the public key.
The receiver hashes the message again and compares the result with the signed digest. If they match, the message is unchanged and came from the holder of the private key.
A valid signature shows integrity, authentication of the sender and non-repudiation. It does not hide the message, so signed data is still readable unless it is also encrypted.
Obfuscation methods
| Method | What it does |
|---|---|
| Steganography | Hides data inside another file, such as an image or audio file |
| Tokenization | Replaces sensitive data with a random token and keeps the real value in a separate secure store |
| Data masking | Hides part of a value, such as showing only the last four digits of a card |
Tokenization and masking are common in payment and customer data. A token has no mathematical link to the original value, so a stolen token is useless without the token store.
Steganography hides the existence of the message, while encryption hides its content. The two can be combined, by encrypting data first and then hiding it.
Picking the right tool
| Need | Tool |
|---|---|
| Prove a downloaded file has not changed | Hash, compared with the published value |
| Prove who sent a message and that it is unchanged | Digital signature |
| Store passwords safely | Salted hash |
| Let support staff confirm a card without seeing it | Data masking |
| Keep card numbers out of an application database | Tokenization |
How the exam asks about this
- "Two accounts with the same password have identical values in the password table." -> No salt is being used.
- "A legal document must prove who approved it, and the approver cannot deny it later." -> A digital signature.
- "A call center agent sees only the last four digits of a customer card number." -> Data masking.
What to remember for the exam
- A hash is one way and fixed length. It supports integrity, not confidentiality.
- MD5 and SHA-1 are weak. SHA-256 and SHA-3 are current choices.
- HMAC uses a shared secret with a hash to prove integrity and sender knowledge.
- Salting defeats rainbow tables and makes identical passwords give different stored hashes.
- A salt is random, unique per password and stored with the hash.
- A digital signature gives integrity, authentication and non-repudiation. It is made with the private key and checked with the public key.
- Tokenization replaces data with a token. Masking hides part of a value. Steganography hides data inside another file.
If the question asks how to prove a file has not changed, think hash. If it asks how to prove who created it, think digital signature.
Common mistakes
Calling hashing encryption. Encryption can be reversed with a key. A hash cannot be reversed.
Skipping the salt. Without a unique salt, two users with the same password have the same stored value, which helps an attacker.
Treating the salt as a secret key. The salt only needs to be unique and random. Its job is to stop precomputed attacks.
Signing with the public key. The private key signs and the public key verifies. The reverse use is for confidentiality.
Treating masking and tokenization as the same. A masked value is a partly hidden form of the data. A token has no mathematical link to the original and depends on a lookup store.
A digital signature does not keep a message private. If the content is confidential, encrypt it as well as signing it.
Check yourself
What does a salt prevent?
It prevents precomputed rainbow table attacks and makes identical passwords give different stored hashes.
Which key creates a digital signature?
The sender's private key. The receiver verifies it with the sender's public key.
How is tokenization different from data masking?
Tokenization swaps the data for a random token with the real value stored elsewhere, while masking only hides part of the value.
Topic 7 of 7 in General Security Concepts
Test yourself on General Security Concepts
The full CompTIA Security+ SY0-801 question bank has 998 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.