Hashing and Message Integrity
Cryptographic hash functions condense data into a fixed fingerprint, letting anyone detect if even a single bit has changed.
A Fingerprint for Data
A cryptographic hash function takes input of any size and produces a fixed-length output, the digest, that acts as a fingerprint of the data. Change one bit of the input and the digest changes completely and unpredictably. This lets you verify integrity: store or transmit the digest, and later recompute it; if it matches, the data is intact; if not, something changed.
Required Properties
- Deterministic: the same input always yields the same digest
- Pre-image resistance: given a digest, you cannot find an input that produces it
- Second pre-image resistance: given an input, you cannot find another with the same digest
- Collision resistance: you cannot find any two inputs with the same digest
- Avalanche effect: a tiny input change flips about half the output bits
Uses
Hashing underlies far more than integrity checks: it verifies downloaded files against a published digest, powers digital signatures (which sign the hash, not the whole message), stores passwords safely (as salted hashes rather than plaintext), and anchors data structures like Merkle trees and blockchains. Common algorithms include the SHA-2 family and SHA-3.
Integrity Versus Authenticity
A bare hash detects accidental corruption but not deliberate tampering, since an attacker who changes the data can also recompute the digest. To bind integrity to a secret, a keyed hash (HMAC) or a digital signature is used, so only someone with the key could have produced a valid tag.
Fusion Context
Hashing supports integrity throughout a fusion program's software and data pipeline: firmware and software artifacts are verified against published digests before use, and signatures over hashes let a device confirm an update is genuine and unaltered. This is part of the code-signing and supply-chain integrity approach applied to the Hyperion breeder and burner tooling.