question: How does one-way encryption for passwords work? How is it possible to convert text into a hash, but not be able to reverse engineer a hash back into text?
comment: The easiest way is to think of a non-secure hash algorithm. Take the letters, represented as 8-bit ASCII numbers, and add them up. Save the last 3 digits of the sum as the hash. In ASCII A=65, B=66, ... . If your password is ABCDEF, that gives a hash of 405. Of course AAAAAO also gives that same value. With this hash you can use arbitrarily complex passwords, and only use 3 digits to store the hash. That's not enough digits to store the hash securely, so SHA-256 uses a much bigger number. The ASCII code isn't random in it's assignment of letters, and so it doesn't really maximize the value of each bit input. Secure hashes essentially encrypt the message and hash the result†. This makes the distribution of hashes more uniform and reduces collisions. Even with keys in the real world, collisions can occur. Your house key opens somebody else's door, but you don't know who. Your password might unlock somebody else's account, but you don't know who. † This is conceptually what happens, not really the math behind how it's done. That math isn't really ELI5.
passages: Unfortunately, we do not have linear perfect hashing, so we have to use an almost linear hash function, i.e. a function "h" such that:
  
  This requires to duplicate the elements of "S" when copying them into "T", i.e., put every element formula_41 both in formula_42 (as before) and in formula_43. So each cell will have 2"R" elements, and we will have to run Conv3SUM formula_44 times.
  
  Section::::3SUM-hardness.
   If a cryptographic hash function is well designed, it is computationally infeasible to reverse the function to recover a plaintext password. An attacker can, however, use widely available tools to attempt to guess the passwords. These tools work by hashing possible passwords and comparing the result of each guess to the actual password hashes. If the attacker finds a match, they know that their guess is the actual password for the associated user.
   Note that 31 bits is a single bit short of a 4-byte word. Thus, the value can be placed inside such a word without using the sign bit (the most significant bit). This is done to definitely avoid doing modular arithmetic on negative numbers, as this has many differing definitions and implementations.
  
  Section::::Tokens.
   Hashing is used in database systems as a method to protect sensitive data such as passwords; however it is also used to improve the efficiency of database referencing. Inputted data is manipulated by a hashing algorithm. The hashing algorithm converts the inputted data into a string of fixed length that can then be stored in a database. Hashing systems have two crucially important characteristics that will now be outlined. Firstly, hashes are "unique and repeatable". As an example, running the word "cat" through the same hashing algorithm multiple times will always yield the same hash, however it is extremely difficult to find a word that will return the same hash that "cat" does. Secondly, hashing algorithms are not reversible. To relate this back to the example provided above, it would be nearly impossible to convert the output of the hashing algorithm back to the original input, which was "cat". In the context of database encryption, hashing is often used in password systems. When a user first creates their password it is run through a hashing algorithm and saved as a hash. When the user logs back into the website, the password that they enter is run through the hashing algorithm and is then compared to the stored hash. Given the fact that hashes are unique, if both hashes match then it is said that the user inputted the correct password. One example of a popular hash function is SHA (Secure Hash Algorithm) 256.
   The document, email, or file to be protected is used to generate a signed hash, a number generated from the contents of the document. Any change to the document, no matter how trivial, such as changing a single bit from a 1 to a 0, will cause it to have a different hash, which will make the signature invalid. To alter a document while purposely maintaining the same hash, assuming the hash function and the program implementing it are properly designed, is extremely difficult. See avalanche effect and hash collision.
  
  Section::::See also.
  
  BULLET::::- Active packaging
  
  BULLET::::- Dye pack
   This is technically not encryption since the data (all bits zero) is not being kept secret; it's widely known to all in advance. However, one of the properties of DES is that it's very resistant to key recovery even in the face of known plaintext situations. It is theoretically possible that two different passwords could result in exactly the same hash. Thus the password is never "decrypted": it is merely used to compute a result, and the matching results are presumed to be proof that the passwords were "the same."
   The stored data—sometimes called the "password verifier" or the "password hash"—is often stored in Modular Crypt Format or RFC 2307 hash format, sometimes in the /etc/passwd file or the /etc/shadow file.
   Ferguson and Saarinen independently described how an attacker can perform optimal attacks against GCM authentication, which meet the lower bound on its security. Ferguson showed that, if "n" denotes the total number of blocks in the encoding (the input to the GHASH function), then there is a method of constructing a targeted ciphertext forgery that is expected to succeed with a probability of approximately "n"⋅2. If the tag length "t" is shorter than 128, then each successful forgery in this attack increases the probability that subsequent targeted forgeries will succeed, and leaks information about the hash subkey, "H". Eventually, "H" may be compromised entirely and the authentication assurance is completely lost.
   If an attacker has the hashes of a user's password, they do not need to brute-force the cleartext password; they can simply use the hash of an arbitrary user account that they have harvested to authenticate against a remote system and impersonate that user. In other words, from an attacker's perspective, hashes are functionally equivalent to the original passwords that they were generated from.
  
  Section::::History.
   BULLET::::- Round 2: Alice sends out formula_19 and a Zero-knowledge proof for the proof of the exponent formula_20. (Note Alice actually derives a new public key using formula_21 as the generator). Similarly, Bob sends out formula_22 and a Zero-knowledge proof for the proof of the exponent formula_23.
  
  After Round 2, Alice computes formula_24. Similarly, Bob computes formula_25. With the same keying material formula_26, Alice and Bob can derive a session key using a Cryptographic hash function: formula_27.
   It follows the approach: Encrypt-then-MAC. In order for the receiver to verify that the ciphertext has not been tampered with, the digest is computed before the ciphertext is decrypted.
  
  Second layer of encryption:
  
  Optionally it is still possible, therefore to encrypt the capsule of the first layer in addition with an AES-256, - comparable to a commonly shared, 32-character long symmetric password. Hybrid Encryption is then added to multiple encryption.
  
  Third layer of the encryption:
  
  Then, this capsule is transmitted via a secure SSL/TLS connection to the communication partner
   Moving a step further, augmented systems for password-authenticated key agreement (e.g., AMP, B-SPEKE, PAK-Z, SRP-6) avoid both the conflict and limitation of hash-based methods. An augmented system allows a client to prove knowledge of the password to a server, where the server knows only a (not exactly) hashed password, and where the unhashed password is required to gain access.
  
  Section::::Factors in the security of a password system.:Procedures for changing passwords.
   For messages selected from a limited set of messages, for example passwords or other short messages, it can be feasible to invert a hash by trying all possible messages in the set. Because cryptographic hash functions are typically designed to be computed quickly, special key derivation functions that require greater computing resources have been developed that make such brute force attacks more difficult.
   After an attacker obtains valid user name and user password hash values (somehow, using different methods and tools), they are then able to use that information to authenticate to a remote server or service using LM or NTLM authentication without the need to brute-force the hashes to obtain the cleartext password (as it was required before this technique was published). The attack exploits an implementation weakness in the authentication protocol, where password hash remain static from session to session until the password is next changed.
   In practice, it is more likely to implement J-PAKE in three flows since one party shall normally take the initiative. This can be done trivially without loss of security. Suppose Alice initiates the communication by sending to Bob: formula_28 and Zero-knowledge proofs. Then Bob replies with: formula_29 and Zero-knowledge proofs. Finally, Alice sends to Bob: formula_19 and a Zero-knowledge proof. Both parties can now derive the same session key.
   When the user logs on, the password entered by the user during the log on process is run through the same key derivation function and the resulting hashed version is compared with the saved version. If the hashes are identical, the entered password is considered to be correct, and the user is authenticated. In theory, it is possible for two different passwords to produce the same hash. However, cryptographic hash functions are designed in such a way that finding any password that produces the same hash is very difficult and practically infeasible, so if the produced hash matches the stored one, the user can be authenticated.
   Section::::Credential recycling.
  
  Credential recycling refers to the hacking practice of re-using username and password combinations gathered in previous brute-force attacks. A special form of credential recycling is pass the hash, where unsalted hashed credentials are stolen and re-used without first being brute forced.
  
  Section::::Unbreakable codes.
   An illustration of the potential use of a cryptographic hash is as follows: Alice poses a tough math problem to Bob and claims she has solved it. Bob would like to try it himself, but would yet like to be sure that Alice is not bluffing. Therefore, Alice writes down her solution, computes its hash and tells Bob the hash value (whilst keeping the solution secret). Then, when Bob comes up with the solution himself a few days later, Alice can prove that she had the solution earlier by revealing it and having Bob hash it and check that it matches the hash value given to him before. (This is an example of a simple commitment scheme; in actual practice, Alice and Bob will often be computer programs, and the secret would be something less easily spoofed than a claimed puzzle solution).
   There are three attacks known that can break the full 16 rounds of DES with less complexity than a brute-force search: differential cryptanalysis (DC), linear cryptanalysis (LC), and Davies' attack. However, the attacks are theoretical and are generally considered infeasible to mount in practice; these types of attack are sometimes termed certificational weaknesses.
   Informally, these properties mean that a malicious adversary cannot replace or modify the input data without changing its digest. Thus, if two strings have the same digest, one can be very confident that they are identical. Second pre-image resistance prevents an attacker from crafting a document with the same hash as a document the attacker cannot control. Collision resistance prevents an attacker from creating two distinct documents with the same hash.
   That is, start by randomly, uniformly and independently selecting two universal hash functions formula_1 and formula_2 to build a double hashing table formula_3.
  
  All elements are put in formula_3 by double hashing using formula_1 and formula_2.
  
  Given a key formula_18, determining the formula_19-st hash location is computed by:
  
  formula_20
  
  Let formula_3 have fixed load factor formula_22.
  
  Bradford and Katehakis
  
  showed the expected number of probes for an unsuccessful search in formula_3, still using these initially chosen hash functions, is formula_24 regardless of the distribution of the inputs.
   In 2-RNSD we want to find in each sub-block not one column, but two or zero such that they would sum up to 0000 (and not to formula_6). In the example, we might use column (counting from 0) 2 and 3 from formula_61, no column from formula_62 column 0 and 2 from formula_63. More solutions are possible, for example might use no columns from formula_63.
  
  Section::::Security proof of FSB.:Linear cryptanalysis.
   Poul-Henning Kamp designed a baroque and (at the time) computationally expensive algorithm based on the MD5 message digest algorithm. MD5 itself would provide good cryptographic strength for the password hash, but it is designed to be quite quick to calculate relative to the strength it provides. The crypt() scheme is designed to be expensive to calculate, to slow down dictionary attacks. The printable form of MD5 password hashes starts with codice_14.
   BULLET::::4. Mallory then sends the signature and document B to Bob, claiming that Alice signed B. Because the digital signature matches document B's hash, Bob's software is unable to detect the substitution.
   Password verification commonly relies on cryptographic hashes. Storing all user passwords as cleartext can result in a massive security breach if the password file is compromised. One way to reduce this danger is to only store the hash digest of each password. To authenticate a user, the password presented by the user is hashed and compared with the stored hash. A password reset method is required when password hashing is performed; original passwords cannot be recalculated from the stored hash value.
  