(a) Explain the difference between encryption and hashing. [4] (b) State one use of hashing in computing. [2] (c) Explain why passwords should be stored as ...

(a) Encryption and hashing are both techniques for transforming data, but they serve fundamentally different purposes. [4]

Encryption is a two-way (reversible) process. Data is transformed into ciphertext using an encryption algorithm and a key. The original data can then be recovered by applying the corresponding decryption key. [1] This makes encryption suitable for protecting data during transmission or storage while still allowing authorised users to retrieve the original content. [1]

Hashing is a one-way (irreversible) process. A hash function takes input data of any length and produces a fixed-length output called a hash value (or digest). There is no key and no way to reverse the process to recover the original data from its hash. [1] Crucially, the same input always produces the same hash, but even a tiny change in the input produces a completely different hash. Different inputs should produce different hashes (a collision, where two inputs share a hash, is extremely unlikely with strong algorithms). [1]

(b) One common use of hashing is password storage. [1] When a user creates an account, the system hashes their password and stores only the hash. When the user logs in, the system hashes the entered password and compares it to the stored hash. This means the actual password is never stored. [1]

Other valid uses include verifying file integrity (comparing hash values to detect modification) and digital signatures (hashing a message before signing it with a private key).

(c) Passwords should be stored as hashes because hashing is irreversible. If a database is compromised by an attacker, the stored hash values cannot be reversed to reveal the original passwords, so user accounts remain protected. [1] In contrast, if passwords were stored in plaintext, an attacker who gains access to the database would immediately know every user's password. Since many people reuse passwords across services, this could allow the attacker to access the users' accounts on other websites too. [1]