I respectfully disagree with the current answers. Hashes are not necessary for a DVCS, see the Bazaar way. You could do as well with any other kind of globally unique identifier. The hashes are a measure to guarantee data integrity: They represent a digest of the information contained in the object (commit, trees, ...) referred to by the hash. Altering the contents without altering the hash (i.e., a preimage attack or collision attack) is believed to be difficult, although not impossible. (If you're really into it, take a look at the 2011 paper by Marc Stevens).
Hence, referring to objects by their SHA hash allows to check if the contents have been tampered with. And, given that they're (almost) guaranteed to be unique, they can be used as revision identifiers, too -- conveniently so.
See Chapter 9 of the Git book for more details.