5️⃣ What Is a Hash Function? SHA-256 as a Mixing Machine (Conceptual)

Hi there and welcome back to this second last session of the series where we will let the mathematics continue as we explore what is a hashing function. Now at its core it has the responsibility of taking an input or a message and transforming it by mixing it up really well into an output called the digest. Now there are many different flavors of hashing functions. We're going to be using one called the SHA 256 and they all pretty much should have at least the following five properties. The first of which is that it should be deterministic. So for example, if I have a message and I place it inside my hashing function, it will produce a digest. Now later on, if I were to use that same message and place it into the hashing function, it would produce the same digest. In fact, if you and I both had access to the same hashing function and I gave you my original message and you place it inside your hashing function, you would get the same digest. It's deterministic. It's sort of like the using a recipe to bake bread. You take the ingredients, you put it in a bowl, and you mix it up hashing function, and it results in a bread dough. Later on, you could follow the same recipe, placing the same ingredients in a bowl, mixing it up, hashing function, and what do you get? The same bread dough. Deterministic. Now, the next property is that it should be irreversible. Meaning that if you have a digest, it should be impossible for you to recover the original message. It would be like me taking that bread dough and breaking it up into its original ingredients in the original state. Now the next property is called the avalanche effect because a small change in an input should result in an extremely large change in the output. So for example, if my message was my name with a lowercase m, I would place it inside the Shaw 256 hashing algorithm and I would get this digest. Let's put to the side. I'm now going to make a small change to the message. I'm going to use an uppercase M. So I'm changing one character. I'm going to place it inside the SHA 256 hashing function and I get a completely different digest. Now looking at these two digests, we can take a look at the next property because they are of a fixed output size and for the SHA 256 it will be 256 bit. Now the last thing I'm going to mention is the following which is the property of very low chance of a collision. This means if I have two different original messages and I place them in to the hashing function, they would each generate the same digest and this should be a very very low likelihood of happening. So, that's pretty much what we need to know about hashing functions. And I'll see you in the last section in the next video as we wrap things up. We'll see you there.

📺 Video 5 – What Is a Hash Function? (SHA-256) Description (for https://youtu.be/R4JcIwoOm-E): What is a hash function, and why do we care about SHA-256 when working with JWTs and ECDSA? In this episode, we treat a hash function as a mixing machine that takes an input and produces a fixed-length digest. We don’t dive into internal bit-level details—just the properties we need for signatures and access tokens. ⸻ In this video We use SHA-256 as our example and explore five core properties: 1️⃣ Deterministic Same input → same output every time. If two people hash the same message with SHA-256, they get the same digest. 2️⃣ One-way / Irreversible Given only the digest, it should be infeasible to recover the original message. Like trying to break finished bread dough back into the exact, original ingredients. 3️⃣ Avalanche Effect A tiny change in the input should cause a huge change in the output. Example: changing just one character (e.g. m → M) produces a completely different SHA-256 digest. 4️⃣ Fixed Output Size No matter how long the input, SHA-256 always produces a 256-bit digest (shown as a fixed-length hex string). 5️⃣ Very Low Collision Probability It should be extremely unlikely that two different messages produce the same digest. Collisions must exist in theory, but a good hash makes them astronomically rare in practice. ⸻ Why this matters for AxM & ECDSA Earlier in the series we: • Learned what an API is • Followed the flow from AxM API account to access token • Built intuition for elliptic curves and key pairs Now hashing fills in another essential role: • Before signing, we hash the JWT header + payload to get a digest h • This digest becomes the compact input to the ECDSA signature process In the final episode, we combine: • private key & public key • nonce k • digest h • and signature components r and s to show how ECDSA signatures are created and how AxM uses them to decide whether to issue an access token. ⸻ Watch the full series 1. Ep 1 – Series Overview https://youtu.be/B5bwqjNmRRU 2. Ep 2 – What is an API? https://youtu.be/TWhw28kYDq8 3. Ep 3 – From AxM API Account to Access Token https://youtu.be/Frkih14QBzs 4. Ep 4 – Elliptic Curves & Keys (Private Number, Public Point) https://youtu.be/a2qkqmjQWwc 5. Ep 5 – What Is a Hash Function? (SHA-256) (this video) https://youtu.be/R4JcIwoOm-E 6. Ep 6 – How ECDSA Signatures Work (Sign & Verify for AxM) https://youtu.be/qbbRMXqMNJg #SHA256 #HashFunction #JWT #AppleSchoolManager