Cryptographic Hashing

Cryptographic hashing maps an input of arbitrary length to a fixed-length output called a hash or digest. For example, SHA-256 produces a 256-bit digest whether the input is a small configuration file or a large backup archive. The same bytes always produce the same digest, while even a small change normally produces a substantially different result. Secure hash functions provide preimage resistance, second-preimage resistance, and collision resistance: recovering an input from its digest, finding a replacement for a particular input, or finding any two inputs with the same digest should be computationally infeasible.

A practical cloud workflow calculates a file's SHA-256 digest before upload, preserves that digest in a trusted manifest, and recalculates it after download or restoration. A mismatch identifies a change, although it does not explain whether the cause was corruption, an incomplete transfer, or malicious modification. Compare the same byte representation at both ends: compression, line-ending conversion, or JSON reserialization changes the digest even when the information appears equivalent. Large files can be hashed incrementally without loading the entire file into memory, but verification still requires reading their contents.

The reference digest must be trustworthy. An attacker who can replace both a file and its adjacent checksum can make a simple comparison succeed. Protect the manifest through separate permissions, immutable retention, or a digital signature. An HMAC combines a secret key with a hash function to authenticate data among parties sharing that secret. Digital signature schemes commonly incorporate hashing and use a private signing key with a corresponding public verification key. For software distribution, verify both the artifact's signature and whether its signing identity is trusted before deployment.

Hashing detects changes; it does not prevent them or restore the original data. Amazon S3 Object Lock protects individual object versions using retention periods or legal holds. Compliance-mode retention cannot be shortened or bypassed during its retention period, whereas governance-mode retention can be bypassed by appropriately authorized requests. S3 Glacier Vault Lock can enforce a vault retention policy that becomes immutable after the lock is finalized. These are retention mechanisms, not hashing algorithms. S3 Versioning preserves versions for recovery, but versioning alone does not prevent an authorized principal from permanently deleting versions.

Service-specific validation also matters. Amazon S3 supports explicit checksum validation, but not every supported checksum is cryptographic: CRC algorithms primarily detect accidental corruption. An S3 ETag is not a universal file hash, particularly for multipart uploads and certain encryption configurations. AWS CloudTrail log file integrity validation uses SHA-256 hashes and digitally signed digest files to support detection of log modification or deletion. Enabling digest delivery does not automatically perform validation; verification must be run separately.

Hashing is not encryption and provides no confidentiality. A digest also does not prove who created a file or when it existed without additional authenticated evidence. Avoid MD5 and SHA-1 where collision resistance is required; use a suitable modern algorithm such as SHA-256. Ordinary fast hashes are also unsuitable for password storage, which requires a purpose-built, salted password-hashing scheme. For exam scenarios, distinguish the requested outcome: hashes detect changes, signatures authenticate signed content, versioning supports recovery, and retention locks prevent prohibited deletion or modification.