I've heard conflicting statements from various CISSP instructors, so I'd like some "real world" perspective:

What is the appropriate terminology for the digest output of the following algorithms:

  • MD5
  • SHA-1, SHA-256, SHA-x

Some folks say that it's appropriate to refer to the digest output as a generic "hash value". Others state that crypto folks will cringe at that as "hash" is specific to SHA (hence "Secure Hash Algorithm).

Additionally, what about output for:

  • HMAC-MD5

Can I get clarification? Additionally, any perspective for the CISSP exam would be appreciated too (I understand that it may be different than practical real-world usage).

  • 1
    Who on earth told you that "hash" is specific to SHA-1? A hash function is a general class of algorithm that simply map an infinite input space to a limited output space. Some of these functions have more targeted uses (for instance, cryptographic hash functions) and one of these function is SHA-1. – Stephane Apr 13 '17 at 14:40

MD5, SHA-1, SHA-256, SHA-384, SHA-512 are examples of methods for message authentication using secure hash functions. When you apply the hash function on the message, you get a "Message Digest". [W. Stallings - Network Security Essentials, 5/e]


I have heard the word "hash" used colloquially to mean the family of algorithms, a specific algorithm, or the output of a hashing algorithm. "Hash value" is also used by some people to disambiguate the output from the algorithm. Regardless, "message digest" is the appropriate term, although some care still should be taken to avoid confusing it with the MD5 algorithm.

To answer your second question, the message digest values that are output from HMAC-MD5, HMAC-SHA1, and CBC-MAC are all properly referred to as "Message Authentication Codes" or MACs.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.