Definition
A cryptographic hash function takes any input — a single byte or a multi-gigabyte file — and produces a fixed-length output called a digest. Good hash functions are deterministic (same input always produces same output), fast to compute, and one-way (you cannot derive the input from the output). They are also collision-resistant: it should be computationally infeasible to find two different inputs that produce the same digest. Common modern hashes include SHA-256, SHA-3, and BLAKE2.
Roles in a VPN
Hashes serve several roles. They verify integrity: any tampering with an encrypted packet changes its hash, and the recipient detects the mismatch. They derive keys: a master secret is run through a key derivation function (HKDF, PBKDF2) that uses a hash internally to produce session keys. They authenticate messages: HMAC combines a key with a hash to produce a code that proves the message came from someone who knows the key. WireGuard, for example, uses BLAKE2s throughout its design.
When Hashes Break
MD5 and SHA-1 were once standard but have been broken by collision attacks and are no longer considered secure for cryptographic use. Up-to-date VPN configurations have removed them. The lesson: a hash function's lifespan is finite, and protocols must allow for migration. TLS 1.3 and WireGuard have both moved to modern hash families with substantial security margins.