Infrastructure

CAS

2002ActivePublished: 16 October 2026Updated: 16 October 2026Published

Key innovation

Addressing data by a cryptographic hash of its content instead of by location/name, which inherently provides deduplication, immutability and integrity verification.

How it works

1) Content (a block/file/blob) is passed through a cryptographic hash function (e.g. SHA-256) that produces a content address. 2) The system checks whether that address already exists — if so it does not store a duplicate (deduplication); if not, it stores the content and maps the address to its physical location. 3) Reads are performed by supplying the content address: the system locates the data and optionally recomputes the hash to verify integrity. A separate metadata directory (names, timestamps, indexes) lets users find the right address, since the hashes themselves are not human-readable. Composing addresses into Merkle structures (trees/DAGs) allows addressing of entire collections and versioning.

Problem solved

Eliminates redundancy and the mutability problem of location-based storage: in traditional systems the same content under different names/paths is stored as multiple copies, with no built-in guarantee that a file was not modified. CAS guarantees one copy per unique content and makes any modification detectable.

Components

Cryptographic hash functionContent address generation

Maps arbitrary content to a fixed, unique identifier (the content address). The determinism of the hash provides deduplication and change detection.

SHA-1

SHA-256

Official

Object (blob) storePhysical content storage

Immutable store holding exactly one copy of each unique piece of content addressed by its hash (write-once).

Official

Address index / metadata directoryAddress resolution and lookup

Maps content addresses to physical locations and stores human-readable metadata (names, timestamps, search indexes), since hashes themselves are not human-readable.

Official

Implementation

Reference implementations

Go · Protocol Labs / IPFS

Implementation pitfalls

Hash collisions and algorithm agingHigh

CAS security relies on the hash’s collision resistance; breaking the algorithm (e.g. SHA-1 collisions — SHAttered, 2017) undermines uniqueness/integrity guarantees and forces migration.

Fix:Use modern functions (SHA-256/BLAKE3) and plan an algorithm-migration path.

Deletion and garbage collectionMedium

Immutability and block sharing make deletion hard: content can be safely removed only when no object references it, requiring reference counting or garbage collection.

Fix:Apply reference counting or mark-and-sweep GC over the address graph.

Evolution

Original paper · 2002 · FAST 2002 (USENIX) · Sean Quinlan

Venti: a new approach to archival storage

Sean Quinlan, Sean Dorward

2002

Venti (Plan 9) — one of the first content-addressed storage servers

Inflection point

Quinlan and Dorward (Bell Labs) describe an archival store where a block is addressed by the hash of its content, with a write-once policy and deduplication.

2002

EMC Centera — commercial CAS system

Centera popularized CAS for fixed-content/compliance use; sales of the original Centera ended in 2018.

2005

Git — CAS in version control

Inflection point

Git is built as a userspace content-addressable filesystem: objects addressed by content hash, Merkle trees ensuring integrity and cheap versioning.

2015

IPFS — CAS in a decentralized network

Inflection point

The InterPlanetary File System uses CAS (hash-based CIDs, a Merkle DAG) to address and share files across a peer-to-peer network.

Hyperparameters (configurable axes)

Hash functionCritical

Choice of hash algorithm (e.g. SHA-1, SHA-256, BLAKE3) determines collision resistance and performance.

SHA-256

BLAKE3

Chunk / block sizeHigh

How and at what granularity content is split into blocks (fixed-size or content-defined, e.g. Rabin fingerprinting) affects deduplication effectiveness.