What the hell is even a Digital Fingerprint ?
Digital fingerprint, as complex as it sounds, is simply just the digest(output) of a hash function. Example:
printf 'adityathebe' | sha256sum 62eb9a06b678df7d48eb59929ab07a9858ed940ddfd3d8596482458133babe67
There you go - we just created a digital fingerprint of the string 'adityathebe'. As simple as that!
The above command may not run on a Windows machine or on MacOS. In that case, you can try online tools to get the sha256 hash - https://emn178.github.io/online-tools/sha256.html
It's important to mention what hash function was used to generate the fingerprint as we can generate different fingerprints for the same data with other hash functions.
printf 'adityathebe' | sha1sum 7d6fa418a5cc416fc8e70551b4ea86fbbd9456d3 printf 'adityathebe' | md5sum 0673288a42e614ad56a7da35e5c88153
There are many more hash functions in addition to these.
Why create digital fingerprints ?
Digital fingerprints are created to ensure Intigrity. Let's imagine I have a will that says I want to donate all of my bitcoins to John Mayer. Here's the
will.txt file where I state just that
I declare that I sign and execute this instrument as my last will to grant all of my million bitcoins to John Mayer.
With that file in hand, I can create a digital fingerprint using sha256.
> sha256sum will.txt 7350c9d592a9b8a514efdf050c4ef658f21f497dab2ba4c1b99d8380da9bfcab
I submit my will along with the fingeprint to the executor.
Now comes sneaky Kanye. Kanye hacks into the executor's system and then changes the will.
I declare that I sign and execute this instrument as my last will to grant all of my million bitcoins to Kanye West.
Kanye having the day of his life
But hold on, the executor can just create the fingerprint again and check if it matches the fingerprint I provided.
> sha256sum will.txt a3571c15b7e5436d7483d26bf01383cf75d2227b298853818c0b8a540d5b2a0b
The two fingerprints do not match. And that's how the executor will know the Will was tampered !
Kanye in shambles
Now, of course, if Kanye was smart he would have changed the fingerprint as well. All he had to do was regenerate the sha256 hash of the modified will.txt file and then saved that as the fingerprint.txt file.
Authentication is not provided by digital fingerprints. Anyone can modify the data and the corresponding fingerprint. There's no way of ensuring that the fingerprint was created by the owner. Due to this reason, digital fingerprints should not be used for security purposes.
This is where digital signatures come in play. Digital signatures offer intrigrity along with authentication.
Read about Digital Signatures on my other blog post.
Digital Fingerprints of Public Keys
Digital fingerprints are extensively used in Public-key cryptography. Public keys in general are very length. You can find my PGP public key here which is around 3000 characters long.
How would you verify that you actually have my correct public keys? Well you can simply check each character one by one or instead compare the digital fingerprint of the public key which is far less tedious. Here's the sha256 digital signature of my public key
1. Github's SSL Fingerprint
You can visit github.com and then click on the lock screen in the address bar to see the certificates. There you can see the sha256 and sha1 digital fingerprints of Github's SSL public key.
2. Fingerprints in GPG
GPG, an encryption tool, also shows the digital fingerprints of the public keys instead of the entire public key.
3. Fingerprints in SSH
When you try to ssh into a new system, the host system's digital fingerprint will be displayed on the prompt.