Listen to this Post
Introduction:
Encoding, hashing, and encryption are frequently confused, yet each serves a unique security purpose. Encoding transforms data for system compatibility (no security), hashing creates irreversible fingerprints for integrity verification, and encryption ensures confidentiality through reversible keys. Misusing one for another leads to data leaks, broken authentication, and compliance failures.
Learning Objectives:
- Distinguish between encoding, hashing, and encryption with practical command-line examples.
- Implement secure password storage using hashing algorithms like SHA-256 and bcrypt.
- Apply encryption for data-in-transit and data-at-rest using OpenSSL and GPG.
You Should Know:
1. Encoding: Not Security, Just Compatibility
Encoding converts data into a different format so systems can transmit or store it without corruption. Base64 is the most common example—used in email attachments, JWT tokens, and API payloads. Encoding is reversible without any secret key, so it never protects sensitive data.
Step‑by‑step guide – Encoding & decoding Base64:
Linux/macOS:
Encode a string echo -n "admin:password" | base64 Output: YWRtaW46cGFzc3dvcmQ= Decode a Base64 string echo "YWRtaW46cGFzc3dvcmQ=" | base64 -d Output: admin:password
Windows (PowerShell):
Encode Decode
Python one‑liner:
import base64; print(base64.b64encode(b"admin:password").decode())
Security warning: Never rely on Base64 to hide credentials. It’s trivial to reverse.
2. Hashing: One‑Way Integrity and Password Protection
Hashing maps arbitrary data to a fixed‑length value. It’s irreversible by design, making it ideal for password storage and file integrity checks. Common algorithms: MD5 (broken, avoid), SHA‑256, SHA‑3, bcrypt (for passwords).
Step‑by‑step guide – Generate file hashes & verify integrity:
Linux:
SHA‑256 hash of a file sha256sum important.docx Store hash for later verification sha256sum important.docx > hash.txt Verify file hasn't changed sha256sum -c hash.txt
Windows (CertUtil):
certutil -hashfile important.docx SHA256
Simulate secure password storage:
Create a password hash (don't use plain echo - use printf) printf "MySecretPass123" | sha256sum Output: 5e884898da28047151d0e56f8dc6292773603d0d6aabbdd62a11ef721d1542d8 To check login: hash the entered password and compare (In production, use bcrypt or Argon2 with salt)
Python example with salt (best practice):
import hashlib, os
salt = os.urandom(32)
password = "MySecretPass123"
hash_obj = hashlib.pbkdf2_hmac('sha256', password.encode(), salt, 100000)
print(hash_obj.hex())
Note: Never use unsalted SHA‑256 for passwords. Use bcrypt, PBKDF2, or Argon2.
3. Encryption: Confidentiality with Keys
Encryption turns plaintext into ciphertext using an algorithm and a key. With the correct key, you can decrypt it. Without it, the data remains protected. Two main types: symmetric (same key for encrypt/decrypt – AES) and asymmetric (public/private key – RSA, ECC).
Step‑by‑step guide – Symmetric encryption with OpenSSL (AES‑256):
Encrypt a file:
openssl enc -aes-256-cbc -salt -in secret.txt -out secret.enc -k "YourStrongPassword"
Decrypt the file:
openssl enc -aes-256-cbc -d -in secret.enc -out decrypted.txt -k "YourStrongPassword"
Windows (using OpenSSL for Windows or PowerShell):
PowerShell 7+ using SecureString (protect text in memory) $Secure = ConvertTo-SecureString "SensitiveData" -AsPlainText -Force $Encrypted = ConvertFrom-SecureString $Secure -Key (1..32) Decrypt $Decrypted = ConvertTo-SecureString $Encrypted -Key (1..32)
Asymmetric encryption (RSA) – for secure key exchange:
Generate RSA key pair openssl genrsa -out private.pem 2048 openssl rsa -in private.pem -pubout -out public.pem Encrypt a small file with public key openssl rsautl -encrypt -inkey public.pem -pubin -in message.txt -out message.enc Decrypt with private key openssl rsautl -decrypt -inkey private.pem -in message.enc -out message.txt
- API Security: Where Encoding, Hashing, and Encryption Collide
Modern APIs use all three: Base64 encoding for tokens (JWT), hashing for request integrity (HMAC), and encryption for payload confidentiality (TLS + optional field encryption).
Step‑by‑step – Generate an HMAC signature (hash + secret key) for API authentication:
HMAC-SHA256 using openssl echo -n "POST /api/v1/transfer amount=1000" | openssl dgst -sha256 -hmac "API_SECRET_KEY"
Python example (API request signing):
import hmac, hashlib, base64 secret = b"api_secret" message = b"amount=1000&to=user123" signature = hmac.new(secret, message, hashlib.sha256).digest() encoded_sig = base64.b64encode(signature).decode() print(encoded_sig)
- Cloud Hardening: Encrypting Data at Rest and in Transit
Cloud providers offer encryption options, but misconfiguration leads to breaches. Always enable:
– Server‑side encryption (SSE) for S3 buckets (AES‑256)
– TLS 1.2+ for data in transit
– Envelope encryption with KMS (Key Management Service)
Example AWS CLI command to enforce bucket encryption:
aws s3api put-bucket-encryption --bucket my-secure-bucket --server-side-encryption-configuration '{
"Rules": [
{
"ApplyServerSideEncryptionByDefault": {
"SSEAlgorithm": "AES256"
}
}
]
}'
TLS verification (Linux):
Check a website's TLS cipher suite nmap --script ssl-enum-ciphers -p 443 example.com
- Vulnerability Exploitation: When Encryption Is Missing or Weak
Common mistakes: using encoding as encryption (e.g., Base64 “encrypted” cookies), weak hashing (MD5 for passwords), or hardcoded encryption keys.
Demo: Cracking a weak password hash (educational only)
Create an MD5 hash (insecure) echo -n "password123" | md5sum Output: 482c811da5d5b4bc6d497ffa98491e38 Crack using John the Ripper (on a hash file) john --format=raw-md5 --wordlist=/usr/share/wordlists/rockyou.txt hash.txt
Mitigation:
- Use bcrypt/Argon2 for passwords (
cost factor >= 10) - Never hardcode keys – use vaults (Hashicorp Vault, AWS Secrets Manager)
- Rotate encryption keys periodically
What Undercode Say:
- Key Takeaway 1: Encoding, hashing, and encryption are not interchangeable; using encoding for security is like locking a door with a sticky note.
- Key Takeaway 2: Hashing without salt and proper iteration count (like plain SHA‑256) leaves passwords vulnerable to rainbow table attacks – always use bcrypt or Argon2.
- Analysis: The post correctly emphasizes that encoding provides zero confidentiality. However, many developers still Base64‑encode session tokens thinking it’s “encrypted.” In penetration testing, we regularly find JWT tokens with `none` algorithm or credentials hidden in Base64. The industry needs more hands‑on training to break this misconception. Real‑world breaches (e.g., Okta 2022, Uber 2016) often trace back to exposed secrets that were merely encoded, not encrypted. Hashing is also frequently misapplied – for example, using a hash to “encrypt” a cookie, which fails because hashes can’t be reversed for session validation. Organizations should mandate secure coding standards that explicitly forbid using encoding for security and require automated secrets scanning (e.g., truffleHog, git-secrets).
Prediction:
As AI‑powered code assistants (Copilot, ChatGPT) generate more production code, we will see an increase in subtle misuses – like suggesting `base64.b64encode()` for password protection or using unsalted MD5 for file integrity. Attackers will automate scanning for these patterns. Within two years, regulatory frameworks (PCI DSS v4.0, ISO 27001:2025) will explicitly require organizations to test for encoding‑vs‑encryption confusion via static analysis and runtime monitoring. The future of secure development will rely on real‑time linters that flag reversible encoding on sensitive data fields and enforce key rotation policies automatically. Meanwhile, post‑quantum cryptography (PQC) will start replacing RSA/ECC, making the distinction between hashing and encryption even more critical – quantum computers won’t break hashing easily, but they will break many encryption schemes. Prepare now by inventorying all cryptographic usage.
▶️ Related Video (74% Match):
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: A Lot – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
