# Concept behind SHA-1 Checksum

What's the basis behind SHA-1 or SHA-2 or other Checksum algorithms? I read about it here http://en.wikipedia.org/wiki/SHA-1#Data_Integrity

But I am still wondering about an answer in a layman's language.

Can I understand it as a very, very compressed code that can be translated back into original data?

Let's say, I have a letter written in notepad. Then the whole of my 1 A4 page size data can be converted into something like this "9b90417b6a186b6f314f0b679f439c89a3b0cdf5". So whenever I want my original data back, I can convert this back into original data?

I am very sure that I am wrong here, because it is weird how data that itself contains combination of letters and numbers can be represented by smaller set of letters and numbers. Illogical!

Then, what's the basic?

-
SHA are one way hashes. You cannot convert the hash back into the original string. – Matt H Dec 17 '12 at 6:38
en.wikipedia.org/wiki/Cryptographic_hash_function for what crypto hash functions are about. – Mat Dec 17 '12 at 6:42
By the way, your intuition that you can't (generally) represent any string with a smaller string is mostly correct. You can do it in many cases (it's called compression), but there's no compression algorithm that always reduces the size of the input data. – Joachim Sauer Dec 17 '12 at 7:43
So, if i have 36 symbols ( 26 letters and 10 numbers ). Can i represent a document having 100 symbols into a document with 99 symbols or lesser with "compression". I don't think so ! – Vishwas G Dec 17 '12 at 10:43
@VishwasGagrani: You probably can if the document has very low entropy. – Brian Dec 17 '12 at 13:59

A hash is a one-way function to digest an arbitrary amount of data into a result. The function shall have the property that for a particular input, it generates the same output.

You could consider addition or multiplication a very horrible hashing function. Given a sum or product, you cannot uniquely determine the numbers that were added or multiplied to produce that result, but you can always given a set of numbers re-add or re-multiply them to test that your set is either probably right, or definitely wrong.

A good hash function scrambles the structure of the source data such that the resulting hash bears very little resemblance to the original data, and has properties that small changes in the input causes large changes in the result.

-

Are you familiar with the concept of a normal checksum? e.g. adding up the ascii values of all the letters in a string?

``````V    I    S    H    W    A    S

86 + 73 + 83 + 72 + 87 + 65 + 83  =  549
``````

The problem with using something so simple to verify the correctness of a transmission is that many simply errors will leave the checksum unchanged.

e.g. if two letters get swapped around, so VISHWAS becomes VIHSWAS, the checksum will be the same.

Or if one letter is wrong and another is wrong in the opposite direction: VISGWBS

With a good hashing function like SHA-1, a small error in the transmission will result in a completely different hash. And it is incredibly unlikely that any two errors will combine to give the same hash result.

-

SHA1/2 and many others are Hash Functions or Cryptographic Hash. The key point of hash functions is that they compute "fingerprint" from arbitrary big data and it should not be possible to:

• Find a data, that has specific hash
• Find 2 different data, that has same hash
• Modify data, so that it will have same hash

Hashes are commonly used for data integrity checks eg. sender sends data and hash of it, receiver gets data, computes hash from them. If hashes are equal, then data were received correctly. Hashes are also used for Digital signatures, where they allow us to use awfully slow asymmetric cryptography to create non-falsible "fingerprint" of data.

-
w.r.t your 1st point, I thought only cryptography has to do with data security. Sha1/2 has only to do with "correctness" of data over the network ? Isn't it ? Sorry, but just want to confirm it again ? I saw it here : en.wikipedia.org/wiki/SHA-1#Data_Integrity – Vishwas G Dec 17 '12 at 6:56
I edited my answer. And no, hashing is general algorithm used for many purposes. Data integrity over network is only one of them. – Euphoric Dec 17 '12 at 7:08
SHA-1 and SHA-2 are cryptographic hashes, so they do try to give strong enough guarantees to be useful in cryptography (and yes, they currently are useful in cryptography). – Joachim Sauer Dec 17 '12 at 7:44

This is what I would tell someone without a computer science or programming background.

A hash is like the hand written signature of a person. But the signatures are unreadable. So unreadable that you cannot tell the name of the person just by looking at the signature. But you still can compare two signatures and decide if the same person signed two different documents.

In this analogy the data is the person, the computed hash is the signature and computing the hash is like asking the person to sign something. If you have computed the hash, you can compare it to another hash. But you have no way to know the data (from which the hash was computed) just by looking at the hash.

-
I think signature analogy is bad, because people might get confused with digital signature, which is little different. – Euphoric Dec 17 '12 at 10:01
@Euphoric You are right. I've tried to make the difference more clear by writing "hand written signature". And I explicitly wanted to answer in "layman's language". – scarfridge Dec 17 '12 at 12:26