Advanced › Module 2 › Lesson 3
Hashes MACs
Hashes and MACs literacy names SHA-256, HMAC, and password hashing — map integrity roles on YOUR $CRYPTO_LAB samples without cracking stranger password dumps.
Visual · t28_hashes_macs
Hash/MAC literacy. $CRYPTO_LAB only. Original Cyberlium.
Opening
Hashes are one-way — MACs prove integrity with a secret — literacy names both before you trust a checksum headline.
Cryptographic hashes (SHA-256, SHA-3) produce fixed-length digests — integrity checks, certificate fingerprints, Merkle trees. HMAC combines hash + secret key for message authentication. Password storage uses slow algorithms (bcrypt, Argon2, scrypt) — never bare SHA-256 for passwords. Cyberlium maps hash/MAC vocabulary on YOUR $CRYPTO_LAB openssl dgst and HMAC demos — never unauthorized hash-cracking on leaked production databases. Next: Primitives Lab.
1. Hash and MAC classes (named)
SHA-256: general-purpose digest — not password storage. HMAC-SHA256: symmetric integrity + authentication with shared secret. bcrypt/Argon2: password hashing with salt and work factor — defender standard.
On $CRYPTO_LAB, compute SHA-256 of a string YOU wrote and note why HMAC needs a secret.
Command guide
Try these commands — Hash and MAC classes (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
PBKDF2 — https://csrc.nist.gov/publications/detail/sp/800-132/final (key derivation literacy)
Optional command
OpenSSL enc options — https://www.openssl.org/docs/manmaster/man1/openssl-enc.html
CWE-326 — https://cwe.mitre.org/data/definitions/326.html (inadequate key strength)
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install openssl
Built-in (vim-common / xxd)
macOS: Built-in
Windows:
Command — copy this
choco install openssl
Use WSL or Git Bash xxd
═══ LINUX / macOS ═══
Command — copy this
export CRYPTO_LAB=${CRYPTO_LAB:-$HOME/cyberlium-lab/t28-crypto}
openssl enc -d -aes-256-cbc -pbkdf2 -in "$CRYPTO_LAB/data/demo.enc" -out "$CRYPTO_LAB/data/demo.dec" -pass pass:LabOnlyPassphrase2026
diff "$CRYPTO_LAB/data/demo.txt" "$CRYPTO_LAB/data/demo.dec" && echo 'Decrypt OK — round-trip verified on YOUR file'
xxd "$CRYPTO_LAB/data/demo.enc" | head -4Primary tools to practice this lesson: openssl, xxd. Reference sites: PBKDF2 (https://csrc.nist.gov/publications/detail/sp/800-132/final); OpenSSL enc options (https://www.openssl.org/docs/manmaster/man1/openssl-enc.html); CWE-326 (https://cwe.mitre.org/data/definitions/326.html). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Defender and builder habits
Verify downloads with published hashes. Use constant-time compare for MACs and tokens. Rotate API secrets; never commit HMAC keys to git. Report weak password storage as finding class — fix with Argon2id.
MD5 and SHA-1 deprecated for security contexts — still appear in legacy systems literacy must flag.
3. Ethics: no stranger dump cracking
Forbidden: cracking leaked production password hashes for 'practice,' sharing rainbow tables aimed at live services. Allowed: hash/MAC matrix — name, purpose, lab demo command on YOUR sample string.
Ship: hash/MAC matrix for $CRYPTO_LAB. Next: Primitives Lab.
4. What you ship: hash/MAC matrix for $CRYPTO_LAB
Three algorithms with purpose and lab demo note. $CRYPTO_LAB named. NO stranger dump cracking. chmod 600.
5. What you record before the next lesson
Date. Hash/MAC matrix. $CRYPTO_LAB named. File t28-m02-l03-hashes-macs.txt chmod 600.
6. Wrong vs right: prod crypto oracles vs CTF toys
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Crack leaked LinkedIn hashes for lab credit. Store passwords as MD5 in YOUR app.
Right
Write hash/MAC matrix for YOUR $CRYPTO_LAB demos. Next: Primitives Lab.
Mission: classify hashes on YOUR lab sample
1) Contrast SHA-256 vs bcrypt purpose. 2) Explain HMAC in one sentence. 3) Flag MD5 as deprecated for security. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Password hashing needs salt + slowness — openssl dgst alone is not enough.
Knowledge Check
APPLY: bcrypt is preferred over SHA-256 for passwords because:
Multiple choice
Knowledge Check
APPLY: True or False: HMAC requires a secret key shared between parties.
True or False
Knowledge Check
APPLY: Cracking stranger leaked password hashes is:
Multiple choice