Cryptographic hash functions

Properties

A cryptographic hash $H : \{0,1\}^* \to \{0,1\}^n$ should be:

• Preimage resistant: given $y$, it’s hard to find $x$ with $H(x) = y$.
• Second-preimage resistant: given $x$, it’s hard to find $x' \ne x$ with $H(x') = H(x)$.
• Collision resistant: it’s hard to find any $x \ne x'$ with $H(x) = H(x')$. Generic attacks need about $2^{n/2}$ work (birthday bound).

Why not for passwords?

SHA-256 is designed to be fast. A GPU can do billions per second, so a leaked table of sha256(password) falls quickly. Password hashing needs a function that is deliberately slow and memory-hungry. That’s Argon2.