Crack a cipher, trust a hash

Julius Caesar reportedly hid messages by shifting every letter three places: A→D, B→E… The shift is the key. It looks like gibberish, but there are only 25 useful keys - and even without trying them all, the text gives itself away: in English, E, T and A are the most common letters, so the most common letter in the ciphertext is probably one of them.

That trick, frequency analysis, was described by the Arab scholar al-Kindi in the 9th century. It breaks every simple substitution cipher.

Modern ciphers like AES are designed so ciphertext looks random and no pattern leaks. They follow Kerckhoffs’s principle: a system should stay secure even if everything about it except the key is public. That’s why the rule is don’t roll your own crypto - use well-reviewed algorithms and libraries, because secret, homemade schemes are almost always breakable.

A cryptographic hash like SHA-256 turns any input into a fixed-size fingerprint (256 bits). Good hashes are:

• deterministic - the same input always gives the same hash;
• one-way - you can’t work back from the hash to the input;
• collision-resistant - you can’t find two inputs with the same hash;
• full of avalanche - change one bit of input and about half the output bits flip.

That’s how software downloads, Git commits and package lockfiles detect tampering. MD5 and SHA-1 are broken (collisions have been produced), so use SHA-256 or newer.