What is a Cryptographic Hash? How does it differ from a regular hash?

0-2 years experience

1. 1Suppose you need to store user passwords in a new service. How would you use a cryptographic hash to store them, and why wouldn't a simple hash like the one used in a hash table be sufficient?
2. 2You have a function that computes a SHA‑256 hash of a file to detect duplicates. If two different files produce the same hash, what does that indicate about the hash function you chose?
3. 3When you generate a hash for a short string to use as a cache key, would you pick a cryptographic hash or a non‑cryptographic one? Explain your reasoning.

2-5 years experience

1. 1Our file‑upload service started rejecting some uploads after we added a checksum verification step using MD5. How would you investigate whether the issue is due to hash collisions or something else?
2. 2We need to implement an API rate‑limiter that uses a hash of the client IP and request payload. What trade‑offs would you consider when choosing a cryptographic vs a fast non‑cryptographic hash?
3. 3During a security audit, a teammate pointed out that we are using a simple modulo hash for session IDs. How would you redesign it using a cryptographic hash, and what impact might it have on performance?

5-8 years experience

1. 1Design a distributed deduplication system that relies on hash fingerprints to identify identical blobs across nodes. How would you choose between a cryptographic hash and a faster non‑cryptographic hash, considering false positives, storage, and network bandwidth?
2. 2Our microservice architecture stores signed payloads where the signature is computed over a hash of the payload. If we switched from SHA‑256 to a non‑cryptographic hash for speed, what security and reliability risks would arise?
3. 3Explain how you would mitigate the risk of hash‑collision attacks in a large‑scale key‑value store that currently uses a non‑cryptographic hash for sharding.

8+ years experience

1. 1We are planning a migration of legacy user authentication data that currently stores unsalted MD5 hashes to a modern scheme. Outline the migration strategy, including how to handle existing passwords, minimize user disruption, and ensure backward compatibility.
2. 2Across multiple services, different teams have chosen various hash functions for data integrity checks. How would you establish a company‑wide policy for hash function selection, balancing security, performance, and operational overhead?
3. 3Our platform needs to support both fast content‑addressable storage and strong tamper evidence for regulatory compliance. How would you architect a solution that uses both cryptographic and non‑cryptographic hashes, and what are the trade‑offs in terms of latency and storage?