Download eBook (PDF) - Red Gate Software

7 – One-Way Encryptionreturning the identical hash value. Since a value secured using one-wayencryption is not decrypted, and its underlying plain text is revealed throughthe comparison of hash values, a hash collision presents a situation in which theactual plain text value cannot be determined.The algorithm selected for the encryption process is critical in reducing thelikelihood of hash collisions. Algorithms that produce lengthy hashes increasethe array of possible values, and so reduce the probability of a hash collision.Of course, the larger the volume of records to which these algorithms areapplied, the higher is the risk of a hash collision. A mathematic problem called"The Birthday Paradox" is commonly referenced as a formula that can beused to determine the probability of hash collisions. While not specific todetermining the probability of hash collisions, the Birthday Paradox formulacan be modified to provide this information.For those who are not mathematics or statistics majors, let's boil this issuedown to its basics:The possible unique combination of values for a single bit is 2 since a bit iseither a 1 or a 0. The possible unique combination of values for a single byte,which is eight bits, would be 256, represented as 2 8 . The algorithm options thatare provided with one-way encryption return either a 128 bit or a 160 bit hashvalue. The possible unique combination of a 128 bit hash would be340,282,366,920,938,460,000,000,000,000,000,000,000, represented as 2 128 .The possible unique combination of a 160 bit hash would be1,461,501,637,330,902,900,000,000,000,000,000,000,000,000,000,000,represented as 2 160 .In order for the possibilities of a hash collision to occur in theIdentification_Value column of the Borrower_Identificationtable, using a 128 bit algorithm, to reach a meager 0.1% it would require avolume of 830,000,000,000,000,000 records; each containing a unique plaintext value.There are other factors that come into play that have influence on the actualpossibilities of a hash collision, such as the internal processing that takes placewithin the algorithm. Regardless, the vulnerability for the occurrence of a hashcollision is real and should be carefully considered.With the selection of the hashing algorithm, inclusion of a salt prior toencryption, and by avoiding use of one-way encryption in tables that have anextremely high volume of rows, the potential vulnerabilities of the techniquecan be mitigated, and it becomes a worthy option to consider when protectingsensitive data.154