MAKING A HASH OF IT

Guest Written by Aaron Van Wirdum

If the Cypherpunks had a mortal enemy, the National Security Agency (NSA) was it. Whereas the group founded by Tim May, Eric Hughes, and John Gilmore set out to protect privacy in a digital age, the NSA had always been concerned about the spread of strong cryptography. The American intelligence agency was tasked with the monitoring, collecting and processing of data, including internet traffic.

But perhaps ironically, the NSA also developed some of the fundamental building blocks for Cypherpunk projects. Specifically, the government agency designed the SHA cryptographic hash function family.

Like any hashing protocol, SHA (Secure Hashing Algorithm) can take any piece of data and convert it into a completely different piece of data: a string of numbers, or hash. Importantly, even a minimal change to the original data — say, the removal of a single comma from an entire book — should result in a completely different hash. Meanwhile, it should be impossible to do the calculation in reverse: if someone only has a hash, this does not enable them to reproduce the original data.

The NSA published its first hashing algorithm, SHA-0, in 1993, but due to security flaws it was quickly replaced by SHA-1. SHA-1 went on to be widely used in various internet protocols, but researchers eventually found flaws in this second-generation algorithm as well: specifically, it turned out that different pieces of data could cause the same hash (“collisions”). The NSA therefore went on to develop the SHA-2 family, including SHA-256, to address these vulnerabilities. Published in 2001 under a royalty-free licence, thus allowing it to be used by anyone who found a use for it, it would provide a stronger foundation for modern internet security. SHA-256 proved to be an excellent algorithm for proof of work functions. Because the output of a SHA-256 hash is entirely unpredictable — there is no way to know what a hash will look like except by actually putting data through the hash function — the only way to find a “valid” hash is through trial and error. For a system like Hashcash, this means that users have to swap in new random numbers in combination with their email data until they find a hash with enough leading zeroes.

In the decades since SHA-2 was first published by the NSA, the set of hashing algorithms has been adopted as a U.S. federal standard (meaning government agencies must use it to protect certain types of sensitive data), and has become broadly adopted and used in other applications as well.

The story of electronic cash is largely one of privacy-conscious developers engineering their own ingenious solutions. They were not averse to borrowing from the brilliance of others, however, even when the big brains in question were the boffins at the NSA — one of the very agencies they were trying to help privacy-conscious users protect against.