Tag
3 articles with this tag.
Using a plain hash as a MAC, with tag = H(secret || message), is a classic mistake. A length-extension attack appends your own data and forges a valid tag without ever knowing the secret. Learn the attack on SHA-256, with runnable Python, and why HMAC exists.
11 min read
Balloon hashing is a memory-hard password hashing function built from an ordinary hash such as SHA-256. Learn how it expands a buffer, mixes it with salt-driven reads, why its memory access never depends on the password, and what attacks it faces.
16 min read
A hash alone can't prove a message wasn't tampered with. Anyone can recompute it. HMAC fixes that by mixing in a secret key, becoming one of the most quietly essential building blocks in TLS, SSH, and beyond.
8 min read
