What is SHA-256 and how to use it on ESP32

In this entry, we will see what SHA-256 is, how it works, and how to use it on an ESP32.

SHA-256 is a secure hashing algorithm that will be very useful when performing tasks such as:

• Authentication: Validating the identity of devices or users.
• Secure storage: Protecting passwords and keys on embedded devices.
• Verifying data integrity: Ensuring that data has not been altered during transmission.

But first, let’s briefly see what SHA-256 is 👇.

What is SHA-256

SHA-256 is a member of the SHA-2 family of hash functions (Secure Hash Algorithm 2) developed by the National Institute of Standards and Technology (NIST).

This hash function takes an input of any length and generates a 256-bit (32-byte) value represented as a 64-digit hexadecimal value.

The SHA-256 hash is a unique and fixed representation of the original data, meaning that any change in the data will generate a completely different hash.

SHA-256 is a one-way algorithm, which means that it is not possible to obtain the original data from the hash.

Implementing SHA-256 on the ESP32

The ESP32 has a hardware encryption module that includes support for SHA-256. This allows for efficient hashing operations without overloading the CPU.

Let’s see how to implement SHA-256 on the ESP32 using the mbedTLS library.

#include "mbedtls/md.h"
#include "stdlib.h"

void printBlockAsHex(std::vector<uint8_t> data)
{
	for(int i = 0; i < data.size(); i++)
	{
		Serial.printf("%02X ", data[i]);
	}
}

std::vector<uint8_t> generateSHA256(std::string& text)
{
	std::vector<uint8_t> hash(32);

	mbedtls_md_context_t ctx;
	mbedtls_md_type_t md_type = MBEDTLS_MD_SHA256;

	mbedtls_md_init(&ctx);
	mbedtls_md_setup(&ctx, mbedtls_md_info_from_type(md_type), 0);
	mbedtls_md_starts(&ctx);
	mbedtls_md_update(&ctx, (const unsigned char*)text.c_str(), text.length());
	mbedtls_md_finish(&ctx, hash.data());
	mbedtls_md_free(&ctx);

	return hash;
}

void setup()
{
	Serial.begin(115200);
	delay(2000);

	std::string message = "www.luisllamas.es";
	auto hash = generateSHA256(message);

	Serial.print(message.c_str());
	Serial.print("\nHash: ");
	printBlockAsHex(hash);
}

void loop() {}

When you run it, you will get something like this.

Practical Examples

// Calculate the hash of the sensor data
unsigned char sensor_data[] = {0x01, 0x02, 0x03, 0x04};
unsigned char hash[32];
mbedtls_sha256(sensor_data, sizeof(sensor_data), hash, 0);

// Send data and hash to the server
send_to_server(sensor_data, sizeof(sensor_data), hash, sizeof(hash));

// Hash the password before storing it
const char *password = "my_secret_password";
unsigned char password_hash[32];
mbedtls_sha256((const unsigned char *)password, strlen(password), password_hash, 0);

// Store the hash in non-volatile memory
store_password_hash(password_hash, sizeof(password_hash));

// Generate an authentication token
char token[64];
snprintf(token, sizeof(token), "%s%ld", "shared_secret", get_current_time());
unsigned char token_hash[32];
mbedtls_sha256((const unsigned char *)token, strlen(token), token_hash, 0);

// Send the hash for authentication
send_authentication_token(token_hash, sizeof(token_hash));