Web 實驗室 · YouTube · 4:32
This segment is the beginning of the 'Permission 101' course. Instructor KK first lists three core concepts developers must clearly distinguish when handling permissions and authentication: hash, encode, and encrypt. The instructor stresses that confusing these three will lead to misunderstandings later when learning mechanisms such as password authentication, tokens, OTP, or JWT. Next, the instructor focuses on 'hash', visually demonstrating its workflow on the whiteboard: an original piece of data (e.g., a document or image) serves as input; after processing by a hash function, it outputs a new value. This segment uses a whiteboard to explain the intuitive property of hashing: original data, after passing through a hash function, becomes unrecognizable and difficult to recover. The presenter further explains that the difficulty of recovery depends on the complexity of the hash algorithm, citing MD5, SHA-256, and SHA-512 as examples; MD5 is described as currently too simple and relatively easy to reverse. A demonstration then illustrates 'lookup table' attacks: if the hash rule is known, one can precompute many input-output pairs and later match a given hash result against the table to infer the original input. Finally, rainbow tables are introduced as a common type of lookup table that stores large numbers of precomputed hash results. This segment primarily explains the one-way nature of hashing and the risk of Rainbow Table attacks. The instructor first illustrates via a whiteboard flowchart that although hashing is mathematically one-way, attackers can exploit precomputed Rainbow Tables: using a captured hash value as an index to look up and indirectly recover the original data. Then, the instructor erases the Rainbow Table-related notes and returns to emphasize hashing's core definition: under normal circumstances, hashed data cannot be directly reversed to the original input through inverse computation. This highlights the contrast between theoretical mathematical one-wayness and real-world engineering security vulnerabilities.
Use the learning inspector for key ideas and moments, or open the reading tabs for the complete notes.
Generated from the video's visuals and explanation; not verbatim speech.
The video begins with instructor KK greeting the audience on camera and stating that today's topic is "Permissions 101", introducing three foundational concepts that must be mastered.
The instructor turns to face the whiteboard and writes the Chinese and English names of these three concepts one by one. First, he writes "Hash (Hash)", then "Encode (Encode)", and finally "Encrypt (Encrypt)". These three terms appear vertically on the board, clear and well-organized.
After finishing the board writing, the instructor turns back to emphasize that although these three terms are often mentioned together, they are fundamentally different. He specifically points out that failing to clarify their distinctions now will lead to flawed logic later when implementing advanced authentication mechanisms such as password verification, tokens, OTPs, or JWTs.
To help viewers grasp the idea intuitively, the instructor begins a detailed breakdown of the first concept: "Hash". Literally, he explains that "hash" (za) means "chaotic" and "cou" means "to assemble", implying a process of scrambling and reassembling data. Then, picking up a red marker, he draws a box on the right side of the whiteboard to represent the original input data (e.g., a file, image, or text). Next, he draws an arrow pointing rightward and labels it "Hash Function" above the arrow. Finally, at the arrow’s end, he draws a second box representing the entirely new value produced by the hash operation. This flowchart vividly illustrates the core characteristic of hash as a one-way data transformation mechanism.
At the start of the segment, the whiteboard already displays 'Hash', 'Encode', and 'Encrypt'; above them is a flowchart: on the left is a document icon, in the center is labeled 'Hash Function', and on the right is another, more chaotic icon. The presenter first explains intuitively that original data becomes highly disordered after hashing, making it difficult to recover the original content from the result.
He then advances the question to 'just how difficult is recovery?', answering that it depends on the complexity of the hash function. The reasoning proceeds as follows: first acknowledging the intuitive irreversibility of hashing, then pointing out that different algorithms vary in strength—and thus in resistance to reversal.
To ground this abstract discussion, the presenter gives familiar examples: MD5, SHA-256, and—verbally added—SHA-512. The whiteboard simultaneously writes 'ex. md5 / sha256', concretizing 'different hashing methods' as comparable algorithm names.
He then uses MD5 as a counterexample, explaining that if a hash function is too simple, it is like insufficient pixelation—still potentially reversible. The emphasis here is not on providing actual cracking steps, but on building the intuitive understanding that 'the simpler the algorithm, the easier the reversal'.
The presenter then explains 'why reversal happens', introducing lookup techniques. His reasoning is: since the hash function itself is a known mathematical rule, one can precompute and list many input-output mappings; later, by matching a given hash result against the right-hand side of such a table, one may infer the original input.
To visualize this idea, he writes 'a -> xxx' and 'b -> ooo' on the whiteboard, circling both pairs of correspondences. Here, xxx and ooo are not actual hash values but illustrative symbols representing a listable relationship: 'some inputs map to some outputs.'
Finally, the speaker transitions from general lookup tables to a common type—the Rainbow Table. After erasing the earlier illustrative notation, he writes 'Rainbow Table' on the whiteboard and verbally explains that it stores a large number of precomputed hash results. The clip ends here, without yet revealing the internal structure of the Rainbow Table.
In information security, although hashing is mathematically one-way, this does not guarantee absolute safety in practice. Attackers can build a database called a 'Rainbow Table', storing large numbers of common strings alongside their corresponding hash values. Once attackers obtain a target's hash value, they simply query the Rainbow Table to directly retrieve the original string that produced that hash—thus bypassing the mathematical one-way restriction. This is why, in subsequent information security courses, we will explain why additional mechanisms are needed to strengthen hashing security.
Now let us refocus on the core concept of hashing. Erasing the Rainbow Table attack method just discussed, we must clearly state the first fundamental fact: hashing is inherently a 'one-way' operation.
This means that, under normal circumstances, after data passes through a hash function (such as MD5 or SHA-256), no direct inverse mathematical operation exists to deduce the original input from the output hash value. This one-way property forms the foundation of hashing technology.
When developing system permissions and authentication, it is essential to clearly distinguish among three easily confused concepts: Hash, Encode, and Encrypt. Each serves distinct mathematical and logical purposes; without proper differentiation, serious misunderstandings will arise later when handling mechanisms such as JWT or OTP.
Hash uses a specific Hash Function to convert input data of any form—such as a file, image, or string—into a completely new, fixed-format value. This is a one-way process of data compression and scrambling, as illustrated in the instructor’s whiteboard flowchart: Input Data → Hash Function → Output Value.
Hash refers to converting original data—such as a file, image, or text—into a new value using a certain method, commonly called a Hash Function. This process is described as "assembling things chaotically together".
This segment first explains hashing intuitively: original data, after passing through a Hash Function, becomes unrecognizable, making it difficult to recover the original content from the result. A flowchart on the whiteboard visualizes this process as 'document → Hash Function → more chaotic result.' This is not a rigorous definition, but an introductory-level intuition.
The speaker points out that the difficulty of reversing a hash result back to its original input depends on how complex the hash function used is. The more complex the algorithm, the more chaotic the output, and the harder it is to recover the original; the simpler the algorithm, the easier it is to reverse. This sets the stage for the subsequent MD5 example.
The clip lists MD5 and SHA-256, and verbally adds SHA-512 as examples of common hashing methods. On the whiteboard, it reads 'ex. md5 / sha256'. These names serve to illustrate differences in complexity among various hash algorithms.
The speaker presents MD5 as an example of 'being too simple,' comparing it to insufficient mosaic coverage—making it relatively easier to decode or recover. The focus here is building intuitive awareness of the risks associated with weak hashing, not a full discussion of MD5's cryptographic weaknesses.
The core idea of lookup is: if the mapping rule of a hash function is known, one can precompute and tabulate many input-output pairs; later, by matching a given hash result against this table, one may reverse-engineer the original input. The speaker uses 'a -> xxx' and 'b -> ooo' as illustrations, indicating that the left side represents inputs and the right side represents outputs.
In this segment, Rainbow Tables are introduced as a common lookup table used to store numerous hash results. The speaker first writes the name and then explains that 'Rainbow' means 'rainbow'. This segment only presents the name and purpose, without elaborating on their chain structure or reduction functions.
A core characteristic of hashing is its one-way property: given an original input, computing its hash value is easy; but given a hash value, recovering the original input via inverse computation is computationally infeasible—or extremely difficult. This mathematical property underpins data integrity and privacy protection.
A practical attack method against hash functions. The attacker precomputes and stores a large number of possible inputs along with their corresponding hash values (i.e., rainbow tables). When a hash value is intercepted, instead of attempting mathematical inversion, the attacker directly performs an index lookup in the table. If a match is found, the original input is instantly revealed. This demonstrates that relying solely on the one-way property of hashing is insufficient to defend against all security threats.
MD5 and SHA-256 are two widely known cryptographic hash functions. They convert data of arbitrary length into fixed-length strings (hash values). In modern information security standards, MD5 is no longer considered secure due to collision vulnerabilities, whereas SHA-256 remains widely used in digital signatures, blockchain, and other fields.
Explore conditions, steps and evidence. Supplementary explanations are labeled separately from content shown in the video.
The whiteboard reads 'Hash Function'
Hash Function
A hash function converts input data into a new value.
Information security and cryptography
The whiteboard displays 'Hash Function', with an arrow connecting a document icon on the left to a hash output icon on the right.
The speaker says, 'It depends on how complex your hash function is.'
Hash Function
A hash function that converts original data into another output; shown here as a flowchart.
Hash operation in information security / cryptography
The whiteboard writes 'ex. md5 / sha256'.
The speaker says, 'For example, MD5,' and later says, 'For example, MD5 is currently considered too simple.'
MD5
A common example of a hash algorithm; the speaker states it is currently regarded as too simple.
Hash algorithm name
The whiteboard writes 'ex. md5 / sha256'.
The speaker says, 'Or SHA-256.'
SHA-256
Another common example of a hash algorithm.
Hash algorithm name
The speaker says, "or something like SHA-512, etc.".
SHA-512 is not written on the whiteboard; it is mentioned orally only.
SHA-512
Another example of a hash algorithm, added by the speaker.
Name of a hash algorithm
The whiteboard shows "a -> xxx".
The speaker says, "For example, its a might become xxx.".
a -> xxx
An illustrative rule using the letter a as input and xxx as output, to demonstrate that mappings can be prelisted.
Illustrative lookup table showing input-output mappings
The whiteboard shows "b -> ooo".
The speaker says, "b might become ooo.".
b -> ooo
An illustrative rule using the letter b as input and ooo as output, to demonstrate that mappings can be prelisted.
Illustrative lookup table showing input-output mappings
Whiteboard displays "Rainbow Table".
The speaker says, "We will have a table called a Rainbow Table," and adds, "Rainbow means rainbow."
Rainbow Table
A common lookup table used to store many hashed results.
A precomputed table used in cryptographic attacks.
The whiteboard displays 'Hash Function'
Hash Function
A hash function converts input data into a fixed-length output (hash value)
Information security, cryptography
The whiteboard displays 'ex: md5 / sha256'
md5
A common hash algorithm name
Cryptographic algorithm
The whiteboard displays 'ex: md5 / sha256'
sha256
A common hash algorithm name
Cryptographic algorithm
The whiteboard displays 'Rainbow Table', which is then erased by the instructor
Rainbow Table
Rainbow table, a precomputed table used to invert hash values
Cryptanalysis
The instructor says, "The first concept is called hashing."
The whiteboard reads 'Hashing Hash'
Hashing refers to converting an original piece of data—such as a document, image, or text—into a new value using some method, typically called a Hash Function. This process is described as "haphazardly assembling" things together.
Original input data exists.
A specific Hash Function is used.
The instructor says, "The second one is called encoding."
The whiteboard reads 'Encoding Encode'
Encoding is the second concept in access control that must be distinguished, spelled Encode in English. This segment of the video only lists the name, without elaborating its specific definition or operation.
The instructor says, "Finally, it's called encryption."
The whiteboard displays "Encryption Encrypt".
Encryption is the third concept in access control that must be distinguished, spelled Encrypt in English. This segment of the video only lists the name, without elaborating its specific definition or operation.
The speaker says, "It's very chaotic; we put it together," "After this hashing, it becomes unrecognizable," and "You'll find it very hard to recover the original input."
The top of the whiteboard already shows "Hash" and a flow diagram where a document is transformed into another icon via a Hash Function.
This segment explains intuitively: after data is hashed, it becomes highly disordered, making it difficult to recover the original content from the result. No rigorous mathematical definition is given here; instead, phrases like "unrecognizable" and "very hard to recover" express the one-way nature.
Suitable for illustrating the intuitive properties of hash functions.
This segment does not state strict assumptions or formal conditions.
The speaker says, "Just how hard is it? Well, it depends on how complex your hash function is." "The more complex your hashing method, the more unrecognizable it becomes… and thus the harder it becomes to recover."
The speaker points out that the difficulty of reversing original data from a hash result depends on the complexity of the hash function used; the more complex the hashing method, the harder the result is to reverse.
used when comparing different hash algorithms
This segment serves only as a qualitative explanation and does not provide quantitative metrics.
The speaker says, "We commonly encounter several types of hashes, for example MD5, or SHA-256, or SHA-512, and so on."
The whiteboard displays "ex. md5 / sha256".
SHA-512 is mentioned orally only and does not appear on the whiteboard.
This segment lists MD5, SHA-256, and SHA-512 as examples of common hashing methods to illustrate differences in complexity among hash functions.
appears as an example
The internal structures or output lengths of these algorithms are not explained.
The speaker says, "If your method is too simple—for instance, MD5 is currently considered too simple—then it is somewhat like applying insufficient mosaic blur, making decoding possible. If our hash function is too simple, it becomes easy for others to recover the original input."
The speaker uses MD5 as an example to illustrate that if a hash function is too simple, it is like mosaic coverage that is insufficient, making it easier to reverse or crack.
Used to illustrate the risks of weak hash algorithms
This segment does not provide specific attack steps or mathematical proofs.
The speaker says, 'This is because there is a technique called lookup tables.' 'Because for MD5, we all know it is a certain mathematical function derived by us mathematically.' 'Since we all know this rule, can we precompute and list all such rules?' 'How similar are the right-hand side of this and that...? Then we can deduce backward: Oh, the original data was this. This technique is called lookup table.'
The whiteboard shows 'a -> xxx' and 'b -> ooo'.
The speaker circles these correspondences, forming two groups of pairings for illustration.
This segment explains: if the mapping rule of a certain hash function is known, one can precompute and tabulate a large number of input-output correspondences; then, by matching a given hash result against the table, one can reverse-lookup possible original data. The whiteboard examples 'a->xxx' and 'b->ooo' are simplified illustrations of such pairings.
Assume the hash rule is known
Assume large-scale input-output mappings can be precomputed
This segment does not discuss collisions, memory cost, or lookup-table hit rate.
The speaker says, 'Then, common tables include one called Rainbow Table.' 'Rainbow means rainbow; Rainbow Table.' 'A Rainbow Table records many such hashed values.'
The whiteboard displays 'Rainbow Table'.
The clip ends at 'records many such hash outputs', without fully explaining the construction details of Rainbow Tables.
The speaker introduces Rainbow Table as a common lookup table used to store numerous hashed results. The clip only gives its name and purpose, without elaborating on its specific generation method.
A common table for lookup attacks
This clip does not explain rainbow chains or reduction functions.
The instructor says: "Hashing is one-way... the hashed data cannot be reversed to recover the original data."
Hashing operations are one-way: given the original input data, one can compute its hash value, but one cannot directly derive the original input data from the hash value.
Applies to standard cryptographic hash functions
The instructor says: "When we look up this Rainbow Table, we can determine how the original item was generated."
The whiteboard displays 'Rainbow Table'
Although hashing is one-way, attackers can build a 'rainbow table' to store precomputed mappings between common inputs and their corresponding hash values. Once an attacker obtains a target hash value, they can simply look it up in the rainbow table to find the matching original input, thereby bypassing the one-way restriction.
A precomputed rainbow table exists
The original input of the target data lies within the dictionary or computational scope of the rainbow table
The instructor emphasizes that these three concepts are critically important when implementing access control; misunderstanding them leads to confusion later regarding password authentication, tokens, one-time passwords, and JSON Web Tokens.
When developing access-control-related features, developers must clearly understand the differences among hashing (Hash), encoding (Encode), and encryption (Encrypt); otherwise, they will misunderstand mechanisms such as password authentication, token authentication, one-time passwords, and JSON Web Tokens.
Learning or implementing access control and authentication features
For all developers learning about access control
The speaker says, 'The more complex your hashing method is, the more unrecognizable the output becomes… and thus the harder it becomes to recover the original.'
No formal statement, quantifiers, or proof are provided—only an oral qualitative assertion.
The more complex the hashing method used, the harder it is to recover the original data from its hash output.
The comparison involves hashing methods of different complexities.
The discussion concerns the difficulty of recovering original data from hash outputs.
Qualitative comparison of common hash methods presented in this segment; universal quantifiers are not explicitly given.
The speaker says, 'For example, MD5 is currently said to be already too simple.' 'If our hash function is too simple, it becomes easy for others to recover the original input.'
'Currently said to be already too simple' is a paraphrase by the speaker; the segment does not provide sources or technical details.
In this segment, MD5 is described as a hash function that is currently considered too simple, and thus more vulnerable to preimage recovery.
Using MD5 as an example.
The discussion focuses on its relative simplicity and the associated risk of reversibility.
A commentary specifically targeting the MD5 algorithm; no formal quantifiers are provided.
The speaker says, 'Because we all know MD5 is a mathematical function derived from mathematics.' 'Since we know this rule exists, can we precompute and list all such rules? … This approach is called lookup table.'
The segment does not specify the feasible range for enumeration, collision handling, or practical limitations.
If the mapping rule of a hash function is known, one can precompute extensive input–output pairs and then reverse-engineer the original input by matching outputs.
The hash function rules are known.
A lookup table can be precomputed and stored.
The target hash result can be compared against entries in the table.
Using MD5 as an example to illustrate the general lookup-table idea; no strict universal quantifier is given.
The instructor draws a flowchart on the whiteboard: a box representing input data on the left, an arrow labeled 'Hash Function' in the middle, and another box representing the new output value on the right.
Set input: draw a box representing an original piece of data (which could be a document, an image, or a text passage).
Instructor says: "Suppose this is my piece of data... it could be a picture; it could be some text."
Apply function: draw an arrow from the input box pointing rightward, and label the arrow 'Hash Function'.
Instructor says: "Through some method, which we usually call a Hash Function."
Generate output: draw another box at the arrow's endpoint, representing the new value produced by hashing.
Instructor says: "It becomes something new... this thing is called the value resulting from hashing."
Hashing is a one-way data transformation process: any form of input data, after being processed by a Hash Function, yields a completely new value.
The speaker begins by asking 'Why would it be recovered?', explains 'There is a technique called lookup tables', gives examples such as 'a might become xxx, b might become ooo', and concludes by saying 'precompute and list all these rules' and comparing the right-hand-side results.
The whiteboard shows 'a -> xxx' and 'b -> ooo'.
The speaker circles the two pairs to indicate pairing.
This is an intuitive derivation, not a rigorous proof; collision handling and table size issues are not addressed.
The speaker first points out that hash functions such as MD5 are known mathematical functions, so their input-output mappings can be understood.
From audio: 'Because we all know MD5 is some mathematical function derived from mathematics.'
Simple symbols are used to demonstrate that certain inputs map to certain outputs.
From the whiteboard formula and audio example: a might become xxx, b might become circle circle circle.
Since the rule is known, we can list all possible mappings in advance.
From the audio: 'Since we all know this rule, can we precompute and list all possible outputs of this rule?'
After obtaining a certain hash result, compare it with the outputs already listed in the table to find the best-matching or identical entry.
From the audio: 'How similar are these two things on the right-hand side? … We just need to find it.'
Once a match is found in the table, we can deduce what the original input was.
From the audio: 'Then we can deduce that, oh, the original data was this. This method is called lookup table.'
The core idea of a lookup table attack is to precompute a large number of input-output pairs using a known hash rule, then reverse-engineer possible original data by matching hash results.
Above the whiteboard, a document icon is drawn, with an arrow labeled 'Hash Function' pointing to another, more chaotic icon.
The speaker says: 'After hashing, it becomes completely unrecognizable. The more complex your hash function is, the more unrecognizable it becomes … and thus the harder it becomes to recover.'
The visual flow illustrates only the concept and does not show any specific algorithm or mathematical expression.
The left-side file is transformed by the middle hash function into a more chaotic right-side icon, representing data transformation.
From the whiteboard flowchart and the speaker's explanation of 'hashing'.
The speaker further explains that higher complexity makes the output appear more chaotic.
From the audio: 'The more complex your hashing method is, the more unrecognizable it naturally becomes.'
Finally, visual chaos is linked to difficulty of reversal.
From the audio: 'Then it becomes increasingly difficult to retrieve it.'
The flowchart and verbal explanation together convey: a hash function transforms original data into a more chaotic result, and the more complex the algorithm, the harder the reverse recovery.
The instructor explains the process of recovering the original data using a Rainbow Table
The flowchart on the whiteboard shows: data -> Hash Function -> hash value
Normal process: original data passes through a hash function to produce a hash value.
Flowchart on the whiteboard and the instructor’s explanation of basic hash concepts.
Attack process: the attacker uses a precomputed rainbow table, querying it with the intercepted hash value as the index.
Instructor says, "when we look up this rainbow table."
Result: by querying the rainbow table, we can directly determine what original data produced that hash value.
Instructor says, "then we can know how this original item was generated."
Rainbow table attacks exploit precomputed lookup tables to successfully reverse the one-way property of hash functions, demonstrating that relying solely on hashing to protect sensitive data—such as passwords—poses security risks.
The speaker says, 'We commonly see several types of hashes—for example, MD5, or SHA-256, or SHA-512, and so on,' then adds, 'For example, MD5 is currently considered too simple.'
The whiteboard writes 'ex. md5 / sha256'.
No actual input string, output hash value, or computation process is provided.
Using common hash algorithm examples to explain: the complexity of different hash functions affects how hard it is to recover the original data from the result.
MD5
SHA-256
SHA-512 is an oral supplementary example.
The speaker says MD5 is currently considered too simple.
Explains that the more complex a hashing method is, the harder it is to reverse; overly simple hashes like MD5 are relatively easier to recover.
First establishes the background of 'different hashing methods' using examples.
From audio and whiteboard: 'ex. md5 / sha256'.
The speaker points out that higher complexity makes the result increasingly unrecognizable and harder to recover.
From audio: 'If your hashing method is more complex… then it becomes increasingly difficult to recover it.'
Again uses MD5 as an example to illustrate that overly simple hash functions are easy to reverse.
From audio: 'For example, MD5 is currently said to be already too simple… and thus easily recoverable by others.'
MD5 serves as the example of 'overly simple and relatively easy to recover'; SHA-256 and SHA-512 serve as other common hashing algorithm examples.
The segment provides no numerical verification or actual cracking demonstration; it only uses verbal examples and a whiteboard listing for explanation.
The whiteboard shows 'a -> xxx' and 'b -> ooo'.
The speaker says, 'For example, its a might become xxx, and b might become circles circles circles.' 'We first list all these rules in advance... how similar are these two things on the right-hand side... then we can deduce backwards: oh, the original data was this.'
The speaker circles these correspondences, forming two pairs.
xxx and ooo are merely illustrative symbols, not real hash outputs.
Demonstrating with minimal symbols how to pre-list hash correspondences and then reverse-lookup original data by matching.
Input a corresponds to output xxx.
Input b corresponds to output ooo.
These correspondence rules are known.
Explaining how the lookup-table method recovers original data by pre-listing and matching.
First write down a correspondence between an input and its illustrative hash output.
From the whiteboard and audio example.
Write down the second input-output pair.
From the whiteboard and audio example.
List many similar pairs all at once.
From the audio: "First, list this rule completely in advance."
After obtaining the target result, compare its similarity or identity with the items on the right side of the table.
From the audio: "How similar are these two things on the right side?"
If the comparison succeeds, the original data can be deduced.
From the audio: "Then we can deduce that, oh, the original data was this."
The illustrative result of the lookup-table method is: using a prebuilt mapping table, possible original inputs can be reverse-looked up from the hash output.
The segment does not provide real hash values or collision checks; it only symbolically illustrates the verification idea.
Instructor writes on the whiteboard, in sequence: "Hash", "Encode", "Encrypt".
Whiteboard.
Blue microphone.
Text.
The whiteboard gradually displays three lines of bilingual Chinese-English text, starting from blank.
The instructor stands in front of the whiteboard.
Writes with a blue marker.
Intuitively lists three easily confused concepts that this lesson needs to distinguish.
The instructor switches to a red marker and draws a flowchart: 'data box → Hash Function → new value box'.
Red marker.
Two boxes.
An arrow.
The text 'Hash Function'.
Draws the complete data transformation flowchart from scratch.
The color changes from blue to red to highlight the current explanatory detail.
The three headings on the whiteboard remain unchanged.
Make the abstract concept of hashing concrete by modeling it as an input-process-output system flow.
At the top of the whiteboard, "Hash" is visible, alongside a document icon, an arrow, the text "Hash Function", and a more cluttered output icon on the right.
The speaker points to the flowchart and makes covering and gesturing motions near the output icon on the right.
Document icon on the left
Text 'Hash Function' and arrow in the center
Hash result icon on the right
The speaker's gestures
The speaker points to different parts of the flowchart
The right hand covers and gestures near the output icon on the right, emphasizing that the result becomes scrambled.
The flow direction is always from the original data on the left, through the Hash Function, to the result on the right.
The main text and graphic positions on the whiteboard remain unchanged.
This diagram visually represents how original data, after passing through a hash function, becomes a different result that is harder to recognize.
The speaker turns to face the whiteboard and writes 'md5 / sha256' sequentially after 'ex.'
Add whiteboard text: "ex. md5 / sha256".
The whiteboard's original flowchart.
The newly written "ex. md5 / sha256".
The speaker holds red and blue whiteboard markers.
Add example text below the whiteboard.
The speaker turns from facing the camera to facing the whiteboard, then back again.
The original list "Hash / Encode / Encrypt" at the top remains visible.
Visually ground the abstract concept of "different hash methods" in concrete algorithm names, helping illustrate differences in complexity.
The speaker writes "a -> xxx" and "b -> ooo" on the whiteboard, then circles these mappings with a red marker.
Add "a -> xxx" and "b -> ooo" to the whiteboard.
The two mappings are circled as a paired diagram.
a maps to xxx
b maps to ooo
red circling line
speaker's gesture
First write down two sets of input-output correspondences
Then circle them to form a visual pairing
The speaker gestures to match the left and right sides
All correspondence directions point from left-side inputs to right-side outputs
The original flowchart and example text remain at the top of the whiteboard
The circling action emphasizes the 'input—output' pairings as objects that can be prelisted and mutually compared, visualizing the core of lookup table attacks.
The speaker picks up the eraser and erases part of the previous lookup table illustration, then rewrites 'Rainbow Table'.
The whiteboard finally displays 'Rainbow Table'.
The exact range of erased handwriting is not fully clear in the fast motion, but it is visible that the hash table illustration is cleared and rewritten with a new term.
Eraser
Original hash table illustration handwriting
Newly written 'Rainbow Table'
The old illustrative mappings a->xxx and b->ooo are erased
The whiteboard is rewritten as 'Rainbow Table'
The speaker verbally explains the term while writing it
The original hash flowchart and 'ex. md5 / sha256' above remain unchanged
Visually transitions from a generic hash table example to the specific technical term 'Rainbow Table', signaling the particular table type to be introduced next.
On the right side of the whiteboard, a box represents input data; an arrow points from it to 'Hash Function', which then points to another box containing doodles representing the output hash value; below it is written 'ex: md5 / sha256'.
Input data box
Hash Function text
hash value box
arrow
algorithm example text
The instructor points with a pen at different parts of the flowchart multiple times during the explanation to aid understanding.
The overall structure of the flowchart remains unchanged.
It visually demonstrates the one-way data flow of hash computation: from plaintext input transformed by a specific algorithm into ciphertext output.
The instructor uses an eraser to remove the words 'Rainbow Table' originally written on the whiteboard.
whiteboard eraser
the words 'Rainbow Table'
the words 'Rainbow Table' disappear from the whiteboard
other content on the whiteboard remains unaffected
Marks the end of the supplementary explanation on rainbow table attacks; the instructor is about to return and summarize the core properties of hashing.
The instructor mentions that misunderstanding the differences among these three will lead to confusion about their meanings later when implementing cryptographic authentication, tokens, OTPs, and JWTs.
Beginners often treat hashing, encoding, and encryption as the same technique or fail to distinguish among them.
These three are entirely distinct concepts. In authorization and authentication systems, each plays a different role; clear differentiation is essential to avoid logical errors when implementing mechanisms such as JWT and OTP.
The speaker describes hash outputs as 'very messy, just pieced together' and 'unrecognizable'.
Analyst's note: This is an intuitive explanation, not equivalent to the formal definition of a hash function.
Learners might think hashing is simply scrambling data randomly.
This segment provides only an intuitive description; strictly speaking, a hash function is a deterministic function whose key property is computational irreversibility—not arbitrary reordering. This clarification is added by the analyst, not stated by the speaker.
The speaker says MD5 is 'too simple' and uses the metaphor 'not enough mosaic coverage'.
The speaker does not distinguish between 'too simple' and more precise cryptographic terms such as 'collision attacks have been proven to exist'.
Learners might interpret MD5's insecurity merely as the algorithm being too simple.
The segment indeed uses 'too simple' as a popular metaphor but does not elaborate on the actual cryptographic reasons. This should be understood as an introductory intuitive explanation, not a complete technical analysis. This reminder is added by the analyst.
The speaker says that after comparing the right half of the result, 'one can deduce backward: oh, the original data was this.'
The speaker does not discuss the case where multiple inputs map to the same output.
Learners might assume that finding a match guarantees a unique correct original.
This segment only demonstrates the intuitive process and does not address collisions or multiple solutions; in practice, table lookup matching does not guarantee a unique preimage. This warning is added by the analyst and was not stated by the speaker.
The instructor emphasizes: "In general, after we hash data—there is no way to recover the original data from the hashed result."
Beginners may assume that because hashing is a one-way function, it is never possible to recover the original data from its hash value.
Although mathematically hashing is one-way (no direct inverse operation exists), in practice attackers can indirectly recover original data using lookup methods such as rainbow tables or brute-force attacks. Therefore, we cannot rely solely on the one-way nature of hashing to guarantee absolute security.
The instructor lists these three terms side by side as three essential concepts to understand for authorization, emphasizing the need to grasp their differences.
Hashing and encoding are two distinct concepts that must be strictly distinguished in authorization development.
The instructor lists these three terms side by side as three essential concepts to understand for authorization, emphasizing the need to grasp their differences.
Hashing and encryption are two distinct concepts that must be strictly distinguished in authorization development.
The instructor lists these three terms side by side as three essential concepts to understand for authorization, emphasizing the need to grasp their differences.
Encoding and encryption are two distinct concepts that must be strictly distinguished in authorization development.
The speaker first explains that hashing completely scrambles data, then asks, "Just how difficult is it? Well, it actually depends on how complex your hash function is."
One must first understand that hashing makes data hard to reverse before one can further understand how the complexity of different hash functions affects reversal difficulty.
After discussing complexity, the speaker immediately gives examples: "We commonly see several types of hashes, for instance MD5, or SHA-256, or SHA-512, and so on."
MD5, SHA-256, and SHA-512 are examples used to illustrate that different hashing methods have different levels of complexity.
The speaker first lists MD5, SHA-256, and SHA-512, then separately says, "For example, MD5 is currently considered too simple."
MD5 is a specific case among common hash algorithms, used to demonstrate that being overly simple makes it easier to recover.
The speaker first states that overly simple hash functions are easy to recover, then asks, "So why can we recover them?" and answers, "Because there is a technique called lookup table."
This segment uses the idea of lookup tables to explain why weaker hash results—such as those from MD5—might be recoverable.
The speaker first defines general lookup tables, then says, "As for common tables, there is a type called Rainbow Table."
Rainbow Table is a common, specific type of lookup table described in this segment.
The instructor first explained how rainbow tables can retrieve the original data, then summarized that hashing is one-way and cannot be directly reversed.
Rainbow table attacks (indirect reversal) contrast with the one-way nature of hashing (direct irreversibility). One-wayness is the mathematical essence of hashing, whereas rainbow tables are a practical attack technique trading computational space for time—undermining the sense of security provided by one-wayness.
The instructor explains the definition and process of hashing.
The instructor emphasizes that these three concepts are distinct and easily confused.
The speaker explains that after hashing, the result is 'completely unrecognizable' and 'very difficult to recover the original input.'
The speaker says, 'It depends on how complex your hash function is,' and 'the more complex the hashing method, the harder it is to recover.'
The whiteboard displays 'ex. md5 / sha256'.
The speaker mentions MD5, SHA-256, and SHA-512.
The speaker says MD5 is 'too simple,' like 'not enough mosaic coverage,' so it is 'easily recoverable.'
The speaker explains 'a technique called lookup tables' and demonstrates with a->xxx and b->ooo.
The whiteboard displays 'Rainbow Table'.
The speaker says this is a common table that records many hashed results.
The whiteboard shows 'a -> xxx' and 'b -> ooo'.
The speaker uses these examples to illustrate precomputing rules and then matching.
A document icon points via a 'Hash Function' arrow to another icon.
The instructor explained the process of retrieving original data using rainbow tables.
The instructor stated that hashing is one-way and there is no way to recover the original data.
Covered · Opening greeting and introduction of the course topic (three concepts of permission 101).
Covered · The instructor writes down and reads aloud the three terms—hash, encode, and encrypt—in order.
Covered · Emphasizing the importance of distinguishing among the three, and their subsequent application scenarios (JWT, OTP, etc.).
Covered · Detailed explanation of the definition of hashing, accompanied by a flowchart illustrating its input-output process.
Covered · It explains how hashing scrambles data beyond recognition and makes reversal difficult, corresponding to the whiteboard flowchart.
Covered · It explains that the difficulty of recovery depends on the complexity of the hash function.
Covered · Lists MD5, SHA-256, SHA-512, and uses MD5 as an example to illustrate the risk of being too simple.
Covered · Explains the idea of lookup-table attacks and demonstrates with 'a->xxx' and 'b->ooo'.
Covered · Introduces Rainbow Table as a common lookup table.
Covered · The instructor explained how rainbow tables retrieve original data via lookup, accompanied by a flowchart on the whiteboard.
Covered · The instructor erases the words 'Rainbow Table' from the whiteboard, transitioning to the next concept.
Covered · The instructor summarizes the one-way nature of hashing, emphasizing that in general it is impossible to directly recover the original data from a hash value.
Reviewed subject paths
Continue with related videos in the same subject.
Bilibili1:19.179000000000002
YouTube1:09
YouTube3:47