Project Abstract

Abstract
In the realm of cryptography and data security, hashing algorithms play a crucial role in ensuring the integrity and confidentiality of sensitive information. Among the widely used hashing algorithms, SHA-1, SHA-256, and MD5 stand out as prominent choices for securing data through hashing functions. This research project aims to compare and analyze the performance, security, and practicality of these three algorithms. SHA-1, developed by the National Security Agency (NSA), is a widely used hashing algorithm known for its efficiency and simplicity. However, over time, vulnerabilities have been discovered in SHA-1, leading to concerns about its security for certain applications. On the other hand, SHA-256, also known as SHA-2, is a more secure hashing algorithm that offers a higher level of protection due to its larger hash size and stronger cryptographic properties. Its widespread adoption in various security protocols and applications attests to its reliability and robustness. In contrast, MD5, while once popular for its speed and ease of implementation, is now considered to be significantly less secure compared to SHA-1 and SHA-256. The vulnerabilities found in MD5, such as collisions and hash value weaknesses, have rendered it unsuitable for many security-critical applications. This research project will involve a comprehensive evaluation of these hashing algorithms based on criteria such as collision resistance, preimage resistance, computational efficiency, and resistance to various cryptographic attacks. By conducting performance tests and analyzing the security implications of each algorithm, this study aims to provide insights into the strengths and weaknesses of SHA-1, SHA-256, and MD5. Furthermore, the practical implications of using these algorithms in real-world scenarios will be explored, considering factors such as compatibility with existing systems, ease of implementation, and overall security posture. By comparing the capabilities and limitations of SHA-1, SHA-256, and MD5, this research seeks to offer recommendations for selecting the most suitable hashing algorithm based on specific security requirements and operational constraints. Overall, this comparative analysis of SHA-1, SHA-256, and MD5 algorithms will contribute to the body of knowledge on cryptographic hashing and assist security professionals and system administrators in making informed decisions regarding data protection and secure communication protocols.

Project Overview

 INTRODUCTION

1.1 BACKGROUND OF THE STUDY

Cryptography is an effective way of protecting sensitive information that is stored on media or transmitted through network communication paths.

Although the ultimate goal of cryptography, and the mechanisms that make it up, is to hide information from unauthorized individuals because most protocols can be broken into and the information can be revealed if the attacker has enough time, desire, and resources. Consequently, a more realistic goal of cryptography is to make obtaining the information too work-intensive to be worthwhile to the attacker and this is done through encryption.

The first encryption methods dated back to four thousand years ago and were considered more of an ancient art. As encryption evolved, it was mainly used to pass messages through hostile environments of war, crisis, and for negotiation processes between conflicting groups of people. Throughout history, individuals and governments have worked to protect communication by encrypting it. As time went on, the encryption algorithms and the devices that used them increased in complexity, new methods and algorithms were continually introduced, and it became an integrated part of the computing world.  Smith,A(2004)

While cryptography is the science of securing of data, cryptanalysis is the science of analyzing and breaking secure communication. Cryptology embraces both cryptography and cryptanalysis. In order words, it is the coding of plaintext and at the same time decoding it. (Smith 2004)

 Cryptanalysis involves the process of an interesting combination of analytical reasoning, application of mathematical tools, pattern finding, patience, determination and luck. In order words, cryptanalyst are also called attackers.

Data that can be read and understood without any special method is called plaintext or clear text. The method of disguising plaintext in such a way as to hide its substance is encryption. The encrypted plaintext (which is unreadable) is known as the cipher text. The process of converting the cipher text back to the plaintext is decryption.

Cryptography can be strong or weak. The cryptographic strength can be measured in the time and resources it will take to recover the plaintext.  (Smith.2004)    

Cryptography currently plays a major role in many information technology applications. For example, when engaging in electronic commerce, customers provide their credit cards numbers when purchasing products. If the connection is not secure, an attacker can easily obtain this sensitive data. In order to implement a comprehensive security plan, the following must be provided:

a)     Confidentiality: Information cannot be observed by an unauthorized party. This is accomplished through public key and symmetric key encryption.

b)   Data security: Transmitted data within a given communication session cannot be altered in transit due to error or an unauthorized party. This is accomplished through the use of hash function and message authentication codes(MACs)

c)     Message authentication: Parties within the given communication session must provide certified proof validating the authenticity of a message. This is accomplished through the use of digital signatures. The only communicating party that can generate a digital signature that will successfully verify as belonging to the originator of the message is the originator of the message. This process validates the authenticity of the message (it shows if the acclaimed originator of the message is really the actual originator of the said message)

d)   Non repudiation: in this case neither the sender nor the receiver of the message may deny transmission. This is accomplished through Digital Signatures and third party notary services.    

e)     Entity authentication: Establishing the identity of an entity such as person or device.

f)     Access control: controlling access to data and resources is determined base on the privilege assigned to the data and resources as well as the privilege of the entity attempting to access the data and resources. Schneier Bruce (1996)