BC1: Hashes: fingerprints for data
Using hashes well
🎯You'll be able to
Choose a hash function, use it correctly in code, and explain what hashes can and can't prove.
🏠The everyday picture
A seal on a jar shows it hasn't been opened, but not who packed it. For that you need a label from someone you trust.
📘What it really is
- Choose a current function: SHA-256 or SHA-3 for general use, Keccak-256 on Ethereum. Don't design your own.
-
Agree the exact bytes: "0.50" and "0.5" are different inputs. Define the encoding (UTF-8 text, JSON with sorted keys, or ABI-encoded fields on Ethereum) before hashing.
-
Domain separation: add a label for what is being hashed (for example "SakhiKosh approval v1"), so a hash made for one purpose can't be reused for another.
-
Integrity, not identity: a hash shows data matches; it doesn't show who made it. Anyone can hash a forged file and publish the new hash. Proving who needs a signature (BC2).
-
Compare safely: compare whole digests in code, and use constant-time comparison when checking secrets.
📝A worked example
Input: the federation wants to publish a fingerprint of each month's accounts.
Steps:
- Agree the format: a CSV with fixed column order, UTF-8, Unix line endings.
- Hash with SHA-256, labelled "G01 accounts 2026-10".
- Publish the digest, signed by the secretary (BC2), so members know who published it.
Expected output: a fingerprint anyone can recompute from the same file, and a signature that shows who stands behind it.
🌍Where it's used
- Ethereum's typed signatures (EIP-712) use a domain to keep signatures for one contract from being reused on another.
- Software releases pair a hash with a signature.
- Document timestamping services anchor hashes in public records.
📝Case scenario
Two offices hashed the same accounts and got different digests. One used Windows line endings and the other Unix. After agreeing the exact format, the digests matched. The lesson: a hash is only as useful as the agreement about what is being hashed.
🖱️Try it
Hash "0.50" and "0.5" with SHA-256 and compare. Success: different digests, and one sentence on why the format must be agreed first.
⚠️Common mistakes
- Inventing a hash scheme. Sign: a home-made "secure hash". Fix: a standard function.
- No agreed encoding. Sign: hashes that don't match for the same data. Fix: define the bytes.
- Treating a hash as proof of who. Sign: "the hash matches, so it's from the bank". Fix: check a signature.
🛠️For your project
Project 2's signed approvals include a domain naming the vault and the chain, so they can't be reused elsewhere.
✅Quick check
What can't a hash alone prove about a file?
Show the answer
Who made it, since anyone can hash a forged file and publish its hash.
Why agree the exact encoding before hashing?
Show the answer
Because different bytes for the same meaning give different hashes.