Use cases for hash functions or what is SHA-256?

5 min readMay 4, 2019

SHA-256 is a hash function. In case you forgot what is a hash function:

Hash function accepts any length of data as an input and outputs fixed length data

History

SHA- 256 is a member of SHA-2 cryptographic hash function family. It was designed by NSA (National Security Agency. Yes, I can hear your skeptic comments but NSA came up with SHA algos when they really needed super secure hash functions to protect your data). Cute-sounding name “SHA” stands for Secure Hash Algorithm and 256 means “256 bit output”.

SHA-256 is a mathematical function that is run on digital data. Computed hash is compared to an expected hash value to verify the data’s integrity. Hash functions in general are one-way to the Labyrinth of the Minotaur. Any piece of data can be hashed but a hash cannot lead to the input data. There is only one way.

Even though all SHA-2 family members execute similar approach and algorithm, main difference is in constraints and sizes of inputs as well as outputs. This will make your life easier when choosing which SHA-2 to choose. For instance, since SHA-256 works with 32-bit words, it will be a good idea to implement SHA-256 instead of SHA-512.

How it works?

On a high level, SHA-256 works like this:

Take the input message and make sure its length (in bits) a multiple of 512 bits. This is done by adding a padding.
Take the passed message and parse it into N 512-bit blocks.
Iterate over all blocks from step 2:

Initialize the message schedule, a sequence of 64 32-bit words
Initialize eight working variables a ... h with the hash values H0 ... H7 from the previous iteration (for the first iteration, H0 ... H7 are initialized with constants).
Perform 64 iterations where working variables a ... h are rotated in a certain manner. This is the heart of the hash function. In this step, the message is inserted into the hash using lots of bitwise mixing.
Compute the new intermediate hash values H0 ... H7 as H0 = H0 + a, H1 = H1 + b and so on.

4. Concatenate H0 ... H7 as the message digest and return it.

Simple example

Every letter has a value of its position in the alphabet. A = 1; B = 2, etc.

for i=0 to len(word):
h = h + (i + letter_value)

And my “SHA-256”ed name looks like this:

Input: Makhmud
Hashed Output: 65b0368e0548b37f9dd1b5b2a31529269f554326f9bb330e97b2ce258a6b1794

I like my SHA-256 name. Maybe I’ll change my name to it. Let’s see what’s your hashed name. You can check here.

Where is SHA-256 is used?

Blockchain

Each block contains a piece of hashed data. Can you guess which hash function is used? YES, SHA-256 (also RIPEMD is used, but this article praises SHA-256, no hard feelings please).

As you can see, a hashed value of previous block is used to calculate the current block’s hash value. An attempt of changing will create a chain reaction that will be seen by everyone. Because one of the beauties of a hash function is it is a unique, one-way-output function. Good luck figuring out the input or making an unseeable change to a blockchain.

Cryptocurrency (Bitcoin)

No. Blockchain and bitcoin are not the same thing. If you want to learn the difference, here you go.

So how SHA-256 works for Bitcoin? SHA-256 is implemented in several aspects of Bitcoin protocol: bitcoin mining, merkle trees and the creation of Bitcoin addresses. Let’s go over mining and addresses:

Mining. SHA-256 is needed when a miner has to produce the previous block hash parameter. In order to do that the miner should follow the formula:

Previous Block Hash = SHA-256(SHA-256(Block Header))

Yes, that’s right. It has to be “SHA-256”ed twice. Is your mind blown yet from its importance?

Generating a Bitcoin address. Core of a Bitcoin address is a public key. The public key has to be hashed by both RIPEMD160 and SHA-256. In other words:

A = RIPEMD160(SHA-256(K))

A public key is 256 bits long. Hashed version of the public key, i.e the Bitcoin address, is 160 bits long. This makes it a lot more convenient for users to use due to the shorter character length aka shorter addresses.

Where A is for Address and K for public key. For other use cases and details, take a look at this article.

SSL (Secure Sockets Layer) Certificates

Secure communications for websites and web services are based on files known as certificates. They are used to establish and authenticate secure connections. These certificates contain cryptographic elements that are generated using algorithms such as SHA-256. At the time of writing this article, SHA-256 generated key has never been compromised, unlike it’s predecessor — SHA-1 (courtesy of Peter Todd, who broke it).

Since December 31, 2016, SHA-256 is an industry standard of signature hash functions for websites.

Encrypted connection between a server and a web browser is also called “SSL handshake”. With this connection credit card information, login credentials and other sensitive data is secure. How it is secure? During the session all user data is hashed via SHA-256. But something tells me that you already figured it out.

Future of SHA-256

What is the future for SHA-256? Where it can be used? I’ll leave it up to your creativity 😉. Let me know when you find a new use case for this beautiful hash algorithm.