In this blog post, we’ll examine how the passwords we use are protected, explore the roles of hash functions and salts, and reflect on the importance of password security.
While studying computer science, I became curious about how passwords are protected. In the past, a hacking incident occurred at “Auction,” a major website that once had 10 million members. When a web service is hacked, a large amount of information stored in the database can fall into the hands of hackers. Not only names, national ID numbers, home addresses, and phone numbers, but even user IDs and passwords can be leaked. Many users, like me, who have difficulty remembering their account credentials tend to use the same ID and password across multiple websites. This means that if a password is leaked from one site, hackers may be able to access accounts on other sites as well. This isn’t just a problem caused by malicious hackers. Since the developers or administrators who created the website also have access to their own databases, how passwords are stored and protected is a critical issue.
So, how can we actually protect our passwords? The secret lies in hash functions. To understand hashing, let’s revisit a past case of a major website being hacked. At the time, the site announced that it was safe even if account information was leaked because passwords were stored in encrypted form. But can we really take this statement at face value? Generally speaking, if encryption exists, one might assume that decryption is also possible. However, the “encryption” mentioned in those announcements was, strictly speaking, a one-way encryption—a concept closer to hashing. Unlike encryption, hashing does not decrypt the original value; instead, it converts the input value into a hash value. Therefore, databases store not the user’s plaintext password, but a hash value derived from the original password to make it difficult to determine the actual password.
A string is converted into a hash value through a hash function, and this process is called hashing. Computer science studies this principle, along with various cryptographic algorithms and security technologies.
Let’s briefly examine how website logins work. When a user signs up, the password they enter is converted into a hash value using a hash function and stored in the database. Every time a user logs in, the entered password is fed into the same hash function to obtain a hash value, which is then compared to the hash value of the password stored in the database. If the two values match, the user is logged in. This allows the website to provide login functionality while storing only the hash value—not the user’s actual password.
So, is it really impossible to reverse hash values back to their original form? To understand the principle more easily, let’s take the example of a name compatibility test based on stroke count, which many of us did in elementary school. Just like in a name compatibility test, if any name you enter yields only one of 100 possible results ranging from 0 to 99, it is difficult to determine exactly which name was entered based solely on the result. This is because many different names can have the same result. Theoretically, it is difficult to identify the original input based solely on the result.
If a hash function with only 100 possible hash values—like the name compatibility test—were used, there would be about a 1% chance that a randomly guessed password would yield the same hash value, allowing a successful login. The dictionary definition of a hash function is a function that takes a bit string of arbitrary length as input and returns a bit string of a fixed length. Since hash functions used in actual services are designed to return sufficiently long hash values, the probability that different passwords will have the same hash value is very low.
However, this does not mean that password hashes are always secure. If a hacker is lucky or uses the right attack method, they can discover the original password corresponding to a hash value. A common method is a dictionary attack. This involves compiling a dictionary of passwords commonly used by users, feeding each password into a hash function to calculate its hash value, and then comparing those values against the hash values in a database obtained through hacking. By repeating this process, attackers can deduce which passwords users have chosen. To address this issue, the concept of a “salt” is used. A salt is a method in which a separate string is appended to a user’s password before it is hashed. By appending a different value to each password before hashing, the resulting hash values can differ even if the same password is used; this makes it more difficult for hackers to identify the original password by comparing it to pre-generated hash values.
Just as there can be no such thing as an invincible shield or an invincible spear, hacking and security technologies in the software field are constantly evolving in a competitive race. Fields related to these cryptographic algorithms are closely tied to computer science in a broad sense and require a great deal of mathematical knowledge. The English name for the Department of Computer Science and Engineering at Seoul National University is “Computer Science and Engineering.” The various technologies needed to create online services, such as Auction, are covered in depth within the field of computer engineering. In other words, the science and technology required to build the online world can be learned through the field of computer engineering.
Finally, let me share one interesting example. In the past, my password for the Seoul National University course registration site was 11111. The reason I set such a ridiculously simple password was not so much to register for classes quickly, but because I believed the site stored passwords in plain text. It was easy to verify this: when I tried the “Forgot Password” feature, it revealed my existing password exactly as it was. If the password had been hashed and stored securely, it would have been impossible to reveal the original password using only the stored hash value.
