SHA-256

What a hash function does

A cryptographic hash function maps arbitrary-length input to a fixed-length output (here, 256 bits) such that finding two inputs with the same output (a collision) is computationally infeasible. SHA-256's collision resistance is approximately 128 bits classically and around 85 bits post-quantum — meaning even a quantum adversary cannot practically find collisions.

SkyeConnex's three uses

1. Per-shard integrity

Every shard carries a SHA-256 hash. On read, the hash is recomputed and compared. Mismatch indicates bit-rot, network corruption, or deliberate tampering — and the platform falls over to one of the remaining shards.

2. Provenance chain

The per-file provenance chain links each operation (upload, read, share, modify) cryptographically via SHA-256 hashes of the previous state. Tampering with any link breaks the chain — making the audit trail tamper-evident without requiring trust in the platform.

3. Public-key fingerprint

The SHA-256 fingerprint of SkyeConnex's ML-DSA-87 issuer public key is published at /security. Customers pin this fingerprint and use it to verify that a key purported to be ours actually is — a standard pattern for offline trust establishment.

Why SHA-256 and not SHA-3

SHA-3 (the Keccak-based family standardised after SHA-2) provides similar security properties with different internal structure — useful as a hedge against unforeseen SHA-2 attacks. SkyeConnex uses SHA-256 because it has substantially more deployment mileage, is hardware-accelerated on every modern CPU, and is the default expectation in FIPS 140-3 certification. SHA-3 is available as a future migration path if cryptanalytic developments warrant it.

Performance

Modern CPUs compute SHA-256 at multiple GB/s per core, accelerated by SHA-NI instructions where present. In SkyeConnex's pipeline, hashing is never a meaningful latency contributor.