If your input is a 20-digit number, then there are 1020 possible inputs.
If your output is a 12 character alphanumeric string, then there are 6212 possible outputs.
If we look closely, we see the bottom number is longer.
Which means there are more possible outputs than inputs.
Which means the hashing is pointless as every possible output can be mapped directly to one input. So that means it would be incredibly easy to break and get the actual numbers back.
So, we'll just use a shorter hash!
What's the point? Just use an integer, a random one if you have to.
Let's take passwords as an example.
You never store a password. You only store the hash. That makes it easy to check a given input against that hash (to see if the provided password is correct) without ever storing the actual password.
This works because:
- our hashing algorithms don't produce the same hash for two inputs easily (collisions
- it is unreasonable to assume that someone could figure out the original input for a given hash
And why is that? Well, the password I used could be 1,000,000 characters long. How are you gonna figure that out from a short hash? You can't. You can only try to calculate as many hashes as you can, compare them to the one you have and hope for a match. In this case it usually isn't even relevant to find the actual, original input as any input that produces the same hash will work.
So, if I'm an attacker and I got a hold of the database with the hashes, I could compare the hashes to a set I previously computed to find a valid input for that hash. This is usually countered by salting your hashes.
So an attacker would be forced to brute-force so long until he found a valid input for a matching hash (which would take forever, because there's an insane amount of possible hashes).
But what if the passwords were limited to a certain length and they could only contain numbers?
This drastically reduces the possible inputs and, thus, the time it would take to brute-force a matching hash.
And that's basically what you're doing when hashing credit card numbers. But it's worse because if the attacker got a match, then it's not just going to be an arbitrary string but, most likely, a valid credit card number!