Hashes MACs

Hashes and MACs literacy names SHA-256, HMAC, and password hashing — map integrity roles on YOUR $CRYPTO_LAB samples without cracking stranger password dumps.

Hashes MACs• Audio Walkthrough

00:00/03:26

Visual · t28_hashes_macs

Hash/MAC literacy. $CRYPTO_LAB only. Original Cyberlium.

Hashes are one-way — MACs prove integrity with a secret — literacy names both before you trust a checksum headline.

Cryptographic hashes (SHA-256, SHA-3) produce fixed-length digests — integrity checks, certificate fingerprints, Merkle trees. HMAC combines hash + secret key for message authentication. Password storage uses slow algorithms (bcrypt, Argon2, scrypt) — never bare SHA-256 for passwords. Cyberlium maps hash/MAC vocabulary on YOUR $CRYPTO_LAB openssl dgst and HMAC demos — never unauthorized hash-cracking on leaked production databases. Next: Primitives Lab.

1. Hash and MAC classes (named)

SHA-256: general-purpose digest — not password storage. HMAC-SHA256: symmetric integrity + authentication with shared secret. bcrypt/Argon2: password hashing with salt and work factor — defender standard.

On $CRYPTO_LAB, compute SHA-256 of a string YOU wrote and note why HMAC needs a secret.

Command guide

Try these commands — Hash and MAC classes (named)

═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)

PBKDF2 — https://csrc.nist.gov/publications/detail/sp/800-132/final (key derivation literacy)

Optional command

OpenSSL enc options — https://www.openssl.org/docs/manmaster/man1/openssl-enc.html

CWE-326 — https://cwe.mitre.org/data/definitions/326.html (inadequate key strength)

═══ INSTALL ═══

Linux (Debian/Ubuntu):

Command — copy this

sudo apt install openssl

Built-in (vim-common / xxd)

macOS: Built-in

Windows:

Command — copy this

choco install openssl

Use WSL or Git Bash xxd

═══ LINUX / macOS ═══

Command — copy this

export CRYPTO_LAB=${CRYPTO_LAB:-$HOME/cyberlium-lab/t28-crypto}
openssl enc -d -aes-256-cbc -pbkdf2 -in "$CRYPTO_LAB/data/demo.enc" -out "$CRYPTO_LAB/data/demo.dec" -pass pass:LabOnlyPassphrase2026
diff "$CRYPTO_LAB/data/demo.txt" "$CRYPTO_LAB/data/demo.dec" && echo 'Decrypt OK — round-trip verified on YOUR file'
xxd "$CRYPTO_LAB/data/demo.enc" | head -4

Primary tools to practice this lesson: openssl, xxd. Reference sites: PBKDF2 (https://csrc.nist.gov/publications/detail/sp/800-132/final); OpenSSL enc options (https://www.openssl.org/docs/manmaster/man1/openssl-enc.html); CWE-326 (https://cwe.mitre.org/data/definitions/326.html). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.

2. Defender and builder habits

Verify downloads with published hashes. Use constant-time compare for MACs and tokens. Rotate API secrets; never commit HMAC keys to git. Report weak password storage as finding class — fix with Argon2id.

MD5 and SHA-1 deprecated for security contexts — still appear in legacy systems literacy must flag.

3. Ethics: no stranger dump cracking

Forbidden: cracking leaked production password hashes for 'practice,' sharing rainbow tables aimed at live services. Allowed: hash/MAC matrix — name, purpose, lab demo command on YOUR sample string.

Ship: hash/MAC matrix for $CRYPTO_LAB. Next: Primitives Lab.

4. What you ship: hash/MAC matrix for $CRYPTO_LAB

Three algorithms with purpose and lab demo note. $CRYPTO_LAB named. NO stranger dump cracking. chmod 600.

5. What you record before the next lesson

Date. Hash/MAC matrix. $CRYPTO_LAB named. File t28-m02-l03-hashes-macs.txt chmod 600.

6. Wrong vs right: prod crypto oracles vs CTF toys

Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.

Wrong: Crack leaked LinkedIn hashes for lab credit. Store passwords as MD5 in YOUR app.
Right: Write hash/MAC matrix for YOUR $CRYPTO_LAB demos. Next: Primitives Lab.

Hands-on Exercise