Irreversible encryption - difference to hash?

Question

I keep reading the term "reversibly encrypted" and that confuses me because I thought that is kind of the point of encryption, that it can be decrypted.

I googled it, as a good student, and found this encyclopedia entry.

irreversible encryption A cryptographic process that transforms data deterministically to a form from which the original data cannot be recovered, even by those who have full knowledge of the method of encryption. The process may be used to protect stored passwords in a system where the password offered is first encrypted before it is matched against the stored encrypted password. Illegal access to the stored password therefore does not permit access to the system.

This brings up the question for me: What is the difference between irreversibly encrypted and hashed passwords? Or is that just another way of naming a hashed password that no one uses?

Answer 1

You are right in being confused about this encyclopedia entry.

An encryption is always reversible, and that is the point about decryption.

The given example in the encyclopedia entry for "irreversible encryption":

The process may be used to protect stored passwords in a system where the password offered is first encrypted before it is matched against the stored encrypted password. Illegal access to the stored password therefore does not permit access to the system.

This exactly describes a hash function rather than an encryption. A hash function can never be reversible because it is not lossless (perhaps with the exception of extremely short plain texts). That's why hash collisions are possible: two hashes may represent more than one plain text.

The word "encoded" is often mixed up with "encrypted", but that's yet another story, to be told in another Stackexchange question.

Answer 2

There is another perspective to consider: "irreversible encryption" can be encryption for which the key is destroyed. There are use cases where this makes sense. But that use case is not described in the encyclopedia entry.

Sometimes you want encrypted data that you want to become inaccessible at some later date. GDPR introduced this use case as a more popular idea in some areas. You keep the key for as long as the data is relevant, then destroy the key. The ciphertext remains stored as a placeholder, but is unreadable. It's easier and more efficient to destroy the key rather than hunt through all your data stores (and backups) to remove the data. And in cases where you need the presence of data, then destroying the data can pose issues with wider data integrity.

However, passwords should be hashed. That's a one-way cryptographic process, but not "encryption"; a distinction that can be difficult to explain to the general public.