Community resourceWorksheet

OCR H446 1.3.1 Hashing for password and data verification

Part 5 of 7 · H446 1.3.1 · Compression, encryption and hashing

Hashing and encryption are routinely confused in H446 1.3.1 answers. This worksheet holds the boundary firmly, treating a digest as something created, recreated and compared but never decrypted, and covers both password verification and checking a file after transfer.

Students will:

  • describe hashing as a repeatable one-way mapping from input data to a digest
  • explain what a verification system should do with the password entered at login
  • set out account creation and a later login attempt as an ordered process
  • state what a digest comparison after a transfer does and does not evidence
  • distinguish encryption, secure password hashing and a hash table used to locate a record

Inside: 6 explanation cells, 1 multiple-choice question, 2 fill-in-the-blanks cells and 3 written answers. 32 marks, about 35 to 45 minutes.

Series: H446 1.3.1 · Compression, encryption and hashing, part 5 of 7.

Shared by Coding PathwayVerified teacher

  • 12 cells
  • About 45 minutes
  • CC BY-SA 4.0
  • Shared 31 Aug 2026
  • Updated 3 Sept 2026

Preview

The whole resource, exactly as a class sees it. Answers and marking are held back.

Hashing for password and data verification

A chosen hash function deterministically maps input data to a digest. Verification repeats the method and compares digests. The stored digest is not decrypted: hashing and encryption solve different problems.

Create, repeat, compare

Password hashing creates and later compares digests Account creationchosen passwordmethod Hillustrative digestdigest-A7K2store digestnot plaintext Login verificationentered candidatesame Hcandidate digestcomparestored digestmatch? The stored digest is not decrypted.A guessed candidate can still be hashed and compared.Digest labels are illustrative, not outputs claimed from a named algorithm.

For the same input and chosen method, the same digest is expected. A changed input is expected to produce a different digest, so comparison can test whether a candidate or file matches. Hash functions used for secure password verification are designed to be one-way: the intended operation does not reconstruct the input from the digest.

Technical honesty matters. Different inputs can theoretically share a digest, and an attacker can still hash guesses and compare them. Strong password-handling systems use carefully selected password-hashing methods and additional protections. Those engineering details are wider reality, not extra named-algorithm recall for OCR 1.3.1.

Worked password-verification journey

At account creation, the service applies method H to the chosen password and stores the resulting digest. At login, it applies the same method and associated settings to the entered candidate, then compares the new digest with the stored one.

  • Match: the candidate is consistent with the stored verification value.
  • No match: reject the login.

The system does not decrypt the digest to recover the original password. Nor can we conclude from hashing alone that the password was never transmitted; that depends on the wider system and protected connection.

Multiple choice1 mark

What should a password-verification system do with the candidate entered at login?

  • ADecrypt the stored digest and compare plaintext characters
  • BLook it up through a hash-table index and return the original password
  • CHash it using the same method/settings and compare the resulting digest with the stored digest
  • DEncrypt it with the user's public key and discard the result
Fill in the blanks4 marks
At account creation, store the password gap 1. At login, hash the entered gap 2 with the same method and gap 3 the digests. A mismatch means the login should be gap 4.
  • digest
  • candidate
  • compare
  • rejected
  • decrypted
Written answer8 marks

Describe account creation and a later login attempt as an ordered state process. Explain why the service does not need to decrypt the stored value and why a weak guessed password can still be a risk.

Use input → hash method → digest → storage/comparison → decision.

Students type their answer here.

Apply the model independently

The remaining tasks change the context or reduce the support. Complete them without copying the worked model, then check that each explanation connects a mechanism to its consequence.

Another use: compare a file before and after transfer

A publisher records the digest of a release file through chosen method H. A recipient obtains the file and independently computes a digest using H. Matching digests provide evidence that the received data matches the version used to produce the recorded digest; a mismatch shows that the data differs.

This is a verification/integrity comparison, not confidentiality. Anyone with the file may be able to read it unless it is separately encrypted. A digest comparison alone also does not prove who created the file.

Written answer6 marks

A research team transfers a dataset and receives a recorded digest through a trusted route. Explain how hashing can check the received data, what a mismatch means, and two things the hash comparison does not provide.

Keep verification separate from secrecy and identity.

Students type their answer here.

Written answer9 marks

Distinguish (1) encryption, (2) secure password hashing, and (3) a hash table used to locate a record. For each, state its input/output purpose and whether reversing to the original data is part of the intended operation.

Hash-table implementation belongs to 1.4.2; it appears here only to prevent a name-based misconception.

Students type their answer here.

Fill in the blanks4 marks
A hash method maps input to a checkpoint gap 1. Password verification hashes the entered candidate and checkpoint gap 2 results. The stored digest is not checkpoint gap 3. Hashing does not by itself provide data checkpoint gap 4.

Review your understanding

Before submitting, check that you can explain the main distinction in your own words, apply it in an unfamiliar context and justify each consequence rather than only naming a feature.