YanoSecA hash function maps input bytes to a digest. A digest written in hex is a representation of that result. One byte takes two hex characters, so a 16-byte result occupies 32 characters. Many constructions can produce the same length; appearance alone cannot identify which one was used.
Provenance records how an artifact was produced. A useful generation record names the input bytes, algorithm, options and computing source. The course’s log records public teaching strings and Python hashlib calls. Compare that evidence with an unlabelled string while keeping the record’s trustworthiness separate from its level of detail.
Before you begin
- Recommended first
- Hex, Base64, and XOR in code, Encoding, hashing, and encryption, Notes: scope, command, result, time, XOR as a puzzle
- Estimated time
- 15 min reading, 15 min activity. Setup and optional practice may take longer.
- Where you work
- Read the printed evidence in a desktop or mobile browser and keep notes on paper or in a text editor. No installation, recovery tool, GPU, real password, live lookup or external account is required. Any later optional tool setup is outside the estimates.
- Without a lab
- All evidence needed for the activity appears on this page. Copy it into notes if downloads are unavailable. Read the labeled model and predict each result; a paper trace practises the reasoning while tool operation waits for a lab. Reading needs no JavaScript. Answer checking needs JavaScript and a secure context; saving progress also needs usable browser storage.
After this lesson you can:
- Count hex characters before naming a digest algorithm.
- Read a generation record that names the hashlib call and the input.
- Leave a 32-character hex string unnamed when no record is attached.
01Example
Fresh authored comparison of provenance quality. These labels are a model, not newly computed digests.
Record C: 64 hex characters; no origin or method supplied.
Record D: input bytes and named SHA-256 call supplied by the exercise author.
D gives a checkable method; C gives only a shape.
Neither shape proves a sender’s identity or that a record is truthful.02Length narrows, and the log names
Python’s hexdigest represents digest bytes as hexadecimal, doubling their byte count. A SHA-256 digest uses 32 bytes and therefore 64 hex characters. A 32-character hex value cannot be the complete ordinary SHA-256 hexdigest, but that mismatch still does not uniquely name its actual algorithm.
MD5 and SHA-1 have known collision weaknesses: different inputs can share an output in ways that undermine uses requiring collision resistance. A familiar length does not establish security either. This lesson asks which provenance is stronger, not whether a digest is suitable for passwords or trustworthy authentication.
Use a generation record to identify a digest method, and leave an unsupported algorithm guess uncertain.Model. A teaching model drawn by hand. It shows the idea, not real tool output.
Read the full explanation below.
Record C
Record C: 64 hex characters; no origin or method supplied.Record D
Record D: input bytes and named SHA-256 call supplied by the exercise author.C has the shape of a 64-hex-character digest
Only length and alphabet are supplied for C.
Shape cannot establish a unique algorithm or a truthful sender.
C: unspecified origin
D: exercise-author method record
Only length and alphabet are supplied for C. Shape cannot establish a unique algorithm or a truthful sender.
Follow the explanation
- Only length and alphabet are supplied for C. Shape cannot establish a unique algorithm or a truthful sender.
- D includes input bytes and a named SHA-256 call. Method provenance does not prove identity or truth.
Read every state and value
1. Only length and alphabet are supplied for C. Shape cannot establish a unique algorithm or a truthful sender.
- Evidence selected
- Record C
- Current claim
- shape
- Source origins
- shape · method
2. D includes input bytes and a named SHA-256 call. Method provenance does not prove identity or truth.
- Evidence selected
- Record D
- Current claim
- method
- Source origins
- shape · method
03Read the activity log
Use only the lamp-note line for the guided activity. Other records remain unworked evidence. The public input and fixed digits are retained from the earlier course record.
Label: shape is not an algorithm name. Digests below that name a call were produced with Python's hashlib. No cracker was run.
Card W1: 32 hex characters, no generation record.
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
Card W2: 32 hex characters, no generation record.
bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb
Neither card names an algorithm.
Activity card: see generation-log.txt, input lamp-note.
Count the hex characters on that md5 line. Predicted count: 32.
The log names hashlib.md5.
Record card: see generation-log.txt, input club-seal.
Count the hex characters on that sha256 line. Predicted count: 64.
The log names hashlib.sha256.
A 32-character hex string is a different length from that sha256 line.
Label: hashlib record for this lesson.
This is not output from John, Hashcat, or CyberChef.
The lines below name the call and the digest.
input: lamp-note
call: hashlib.md5
hexdigest: 878f92ed6d030750ad4ca639dc68ab67
hex character count: 32
input: club-seal
call: hashlib.sha256
hexdigest: 9d48a656963421ca1d395541b17d9f9d162d311a7184eda7804cfa98815855d5
hex character count: 64
input: night-desk
call: hashlib.sha256
hexdigest: 6cc43bad95b52c301ed7f9cbd57e79c5d28a0626f473722e4507476a2bc97690
hex character count: 64
night-desk is a second sha256 record for the module case. It is not lamp-note.
- Find lamp-note in generation-log.txt. Copy its named call, hashlib.md5, and the displayed digest into notes.
- Count the hex characters in groups of four. Eight groups give 32 characters, corresponding to 16 result bytes.
- Write a bounded claim: this supplied generation record names MD5 for this input. State that the count alone would not name it.
- Stop after that line; do not submit these public strings to a password-recovery tool.
04Optional challenge
In about ten optional minutes, draft an empty provenance form with input bytes/encoding, method/options, output, source and time. Explain how recomputing under a known method could check the record’s consistency without proving who originally created it.
05Fresh cases for the checks
Use these fictional cases for the checks below. They have different inputs from the worked examples. Read them here or make notes; no installation or external service is needed.
Shape card A: independent unknown hexOwned fixture. An original file made for this course. Follow the activity's instructions in your own lab.
Unknown value, grouped only for counting:
0123 4567 89ab cdef 0123 4567 89ab cdef 0123 4567 89ab cdef
No method, input or source record accompanies it. Spaces are display grouping, not part of the value. Ordinary hex uses two characters per byte.
Generation card B: supplied record, not a new computationOwned fixture. An original file made for this course. Follow the activity's instructions in your own lab.
B1 input bytes: empty byte string, b"".
B2 named call: hashlib.sha256.
B3 claimed hexdigest: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855.
This card provides a checkable generation claim; no recomputation or source authentication is performed here.
Comparison card C: separate evidence qualityOwned fixture. An original file made for this course. Follow the activity's instructions in your own lab.
C1: 32 hex characters with no generation record.
C2: a record supplies exact input bytes, named method and output. Its author identity is unverified.
C3: a copy of C2, with no independent acquisition.
06Explain the evidence and its limit
Optional self-check: write a provenance form with exact input/encoding, method/options, output, source and time.
Review it: distinguish bytes from hex character count, leave a shape-only method unknown and separate a reproducible record from authenticated authorship.
07Common mistakes
If you name an algorithm from length alone, list what the record is missing. Several methods or truncated outputs may fit the same shape.
If you confuse bytes and hex characters, divide the character count by two for ordinary hex representation.
If a named method is treated as a guarantee of truth, distinguish a detailed claim from independent confirmation.
References
- Python 3.12: hashlib
Digest and hexdigest describe result size and hex representation; the module also warns about MD5/SHA-1 collision weaknesses.