Hack the Route Start free Open app Encryption and trust
Hashing, salting and key exchange
The building blocks under TLS and passwords: one-way hashes, salts, key pairs and agreeing a key in public.
A hash (SHA-256) turns any data into a fixed-size fingerprint that cannot be turned back; change one bit and the fingerprint changes completely. Systems store a password's hash, not the password. A salt, random bytes stored beside each hash, makes two equal passwords hash differently, so one precomputed table cannot crack them all; slow hashes (bcrypt, scrypt, Argon2) make each guess expensive. Symmetric encryption (AES) uses one shared key: fast, but both sides need it. Asymmetric keys come in pairs: what the public key locks only the private key opens, and what the private key signs anyone can check with the public key. Key exchange (Diffie-Hellman) lets two sides agree a shared key over a network others can read, and TLS, SSH and VPNs all start with one. PKI is the system of certificate authorities that vouch for whose public key is whose.