# Can you help me understand hash-preserving encryption?

I have rather simplistic understanding of cryptography, so I have to beg a pardon in advance if the question has internal contradictions.

Imagine data $A$ with a hash $hashA$. This data is encrypted with private key $K$ to get data $E$ and the hash of the encrypted data is $hashE$.

1. Are there encryption method and hashing method, which will allow to verify, given $hashA$, $hashE$ and $K$, that $hashE$ is indeed a hash of “A encrypted with K”?

2. How secure could that algorithm be against attempted forgeries, i.e. someone having access to $A$ creating $E$ and $K$, so that $hashA$, $hashE$ and $K$ are correct in sense of $1$, but $E$ is not “A encrypted with K”?

Clearly the identity hash $(hash(x)=x)$ works, but I'm more interested in hashes which are significantly smaller than the original data.

-
You're encrypting with the private key? What encryption scheme are you using? – pg1989 Nov 30 '13 at 21:50
The question if there is any encryption / hash pair which will make it work, there is no specific scheme I have in mind at the moment. – Kamal Dec 1 '13 at 9:46
Probably there is no way to achieve unforgeable hashes. The reason is, that you would need some kind of structure preservation over the schemes, but cryptographic hashing and symmetric encryption both "destroy all structure", s.t. you can only check for equal inputs and nothing else. So any kind of relation or structure of corresponding plaintext and ciphertext will not be preserved by the hash function. Btw, there is no "identity hash", because hash functions are defined as arbitrary length input/fixed length output functions(even non-crypto hash functions). – tylo Dec 2 '13 at 13:40
Tylo, thanks for the input. I agree it's unlikely full security can be achieved this way, so I'm looking towards partial security, where forgery would be merely complicated not impossible. It seems to me that "destroying all structure" property can be still hold, but because of some interplay between encryption method and hashing method we could draw an inference mentioned in 1. Well, clearly my intuitiin in crypto is rather weak. – Kamal Dec 2 '13 at 19:17

$\def\Enc{\operatorname{Enc}}$ Take a simple hash function $H$ and encryption function $\Enc_K$.
Then define $E = (\Enc_K(H(A)), \Enc_K(A))$ as the encryption, $hashA(A) = H(A)$ and $hashE(x,y) = x$.
Then we have $hashE(E) = \Enc_K(H(A))$, which of course is easy to check against $H(A)$, given $K$.
Of course, this in no way satisfies your unforgability requirement: Only someone with access to both $E$ and $K$ can check if the hash part of $E$ matches the rest of it.