Deterministic digests and finite output spaces
A fixed-output hash deterministically maps permitted messages to a digest of a specified length. More possible inputs than outputs imply collisions exist; the security objective is computational difficulty, not their mathematical impossibility.
Interpretation requires an algorithm and output length. SHA-2 and SHA-3 contain distinct functions, while extendable-output functions such as SHAKE allow requested output lengths. These names do not denote one interchangeable fixed-length algorithm.
Preimages, second preimages and collisions
Preimage resistance concerns finding an input for a supplied target digest. Second-preimage resistance starts with a given message and seeks another with its digest. Collision resistance lets the attacker choose both distinct messages.
These are different attack conditions. Digest length is not every attack’s security strength: NIST lists SHA-256 collision strength as128 bits and preimage strength as256. “Irreversible” alone does not specify all required properties.
Integrity comparison needs a trusted reference
Comparing against a digest obtained through a trusted channel can test consistency. If someone can replace both the message and expected digest, they can hash their replacement too. An unkeyed digest alone does not identify its author.
HMAC combines a shared secret with a designed hash construction for authentication. Historical examples are not current recommendations: NIST has published a transition away from remaining SHA-1 uses, so deployments must check current requirements.