Hash and then Encrypt?

Recently, I came across some code that did this. It makes no sense to do this.

Hashing an input before encrypting it with an algorithm like DES/AES is generally unnecessary. Here’s a breakdown of when and why you might or might not do this:

1. When It Does Make Sense

  • Data Integrity Verification: If you hash the input and send both the hash and the encrypted data, the recipient can decrypt the data, hash it again, and compare it to the transmitted hash. This ensures the data has not been tampered with during transit.
  • Fixed-Length Input Requirement: If the encryption process or protocol has a requirement for fixed-length inputs, hashing (which produces a fixed-length output regardless of input size) could standardize the input size.

2. When It Does Not Make Sense

  • Loss of Original Data: A hash is a one-way transformation, meaning you cannot recover the original input from it. If the hash replaces the original data, the original content will be lost.
  • Added Complexity Without Benefit: Encrypting the raw data directly with DES achieves confidentiality. Hashing it first adds complexity but doesn’t inherently improve the encryption’s security.

3. Better Approaches

  • Encrypt-then-MAC: For ensuring both confidentiality and integrity, the standard approach is to first encrypt the data and then apply a Message Authentication Code (MAC) to the ciphertext.
  • Modern Encryption Standards: DES is outdated and considered insecure. You should use modern encryption algorithms like AES, which natively support modes (e.g., GCM, CCM) that provide both encryption and integrity.

Summary

Hashing before encrypting with DES only makes sense in specific use cases, such as ensuring integrity or meeting fixed-length requirements. Otherwise, it’s redundant and complicates the system without improving security.

Anuj holds professional certifications in Google Cloud, AWS as well as certifications in Docker and App Performance Tools such as New Relic. He specializes in Cloud Security, Data Encryption and Container Technologies.

Initial Consultation

Anuj Varma – who has written posts on Anuj Varma, Hands-On Technology Architect, Clean Air Activist.

 Twitter Linkedin