Encryption and hashing: ciphers, symmetric and asymmetric keys, MD5, SHA and HMAC
In short: Encryption hides data by turning plaintext into ciphertext with an algorithm and a key. Symmetric algorithms such as AES use one shared key; asymmetric algorithms such as RSA and ECC use a public/private pair. Hash functions such as SHA-256 fingerprint data, and HMAC adds a secret key to prove authenticity.
Encryption basics
Encryption converts information into a secret code that hides its meaning. The science of encrypting and decrypting is cryptography. Unencrypted data is called plaintext; encrypted data is ciphertext; the formula used is the algorithm or cipher, and the secret value that controls it is the key.
Classic ciphers
- Transposition: rearranges the order of letters without changing them. Example: writing a message in rows and reading it out by columns.
- Substitution: replaces each letter with another. The Caesar cipher shifts every letter by a fixed amount (shift 3: A→D, so
HELLO→KHOOR). The Vigenère cipher uses a keyword so the shift changes letter by letter. - One-time pad: combines the message with a truly random key as long as the message, used only once. Mathematically unbreakable, but impractical to distribute.
Classic ciphers are easily broken by computers today, but they show the two core ideas behind all modern algorithms: confusion and diffusion.
Symmetric and asymmetric encryption
| Symmetric | Asymmetric (public key) | |
|---|---|---|
| Keys | One secret key shared by both sides | A public key (shareable) and a private key (kept secret) |
| Speed | Very fast; used for bulk data | Much slower; used for small data |
| Main challenge | Getting the key safely to the other side | Making sure a public key really belongs to its owner (certificates) |
| Current examples | AES (use this), ChaCha20 | RSA, elliptic-curve (ECC), Diffie-Hellman for key exchange, DSA/ECDSA for signatures |
| Outdated | DES, 3DES, RC4, IDEA, Blowfish | RSA keys shorter than 2048 bits |
In practice both are combined: protocols such as TLS and IPsec use asymmetric cryptography to agree a key securely, then symmetric AES to encrypt the data.
Cryptographic hash functions
A hash function turns any input into a fixed-length fingerprint (digest). A good cryptographic hash is:
- one-way: you can't get the input back from the hash;
- collision-resistant: it is infeasible to find two inputs with the same hash;
- sensitive: changing one bit of input changes the output completely.
| Algorithm | Output | Status |
|---|---|---|
| MD5 | 128 bits | Broken; only for non-security checksums |
| SHA-1 | 160 bits | Broken for security; legacy only |
| SHA-256 / SHA-512 (SHA-2) | 256 / 512 bits | Secure; the everyday choice |
| SHA-3 | 224–512 bits | Secure; different internal design |
Try them yourself with the hash calculator.
HMAC and digital signatures
A plain hash proves data wasn't changed, but anyone can recompute it. A Keyed-Hash Message Authentication Code (HMAC) mixes a shared secret key into the hash, so it proves both integrity and authenticity. IPsec, TLS and API signatures use HMAC.
A digital signature does the same with asymmetric keys: the sender signs a hash with their private key, and anyone can verify it with the sender's public key. This also provides non-repudiation, because only the private-key owner could have signed.
Practice
Encrypt CAT with a Caesar shift of 3.
Why do protocols like TLS use both asymmetric and symmetric encryption?
What does HMAC add to a normal hash?
Key takeaways
- Encryption turns plaintext into ciphertext using an algorithm and a key.
- Classic ciphers use transposition or substitution; the one-time pad is unbreakable but impractical.
- Symmetric (AES) is fast with one key; asymmetric (RSA, ECC) uses a key pair.
- Use SHA-256 or better; MD5 and SHA-1 are broken for security.
- HMAC proves integrity and authenticity; digital signatures add non-repudiation.
Original content written by Mohamed Fayas for FM TecHub. © 2026 FM TecHub. You're welcome to share a link to this page; please don't copy the text elsewhere without permission.