Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am looking for practical constructions for Full Domain Hash.

I have read Random Oracles are Practical by M. Bellare and P. Rogaway, the construction suggested on page 8, under "Uniformity: a technicality", but it's unclear whether that is producing a full domain hash, or just ensuring the message is well-formed using an existing hash function.

I haven't found any other information regarding full domain hash constructions.

share|improve this question
Full Domain Hash practice that I'm aware of includes RSASSA-PSS as in PKCS#1v2; and ISO/IEC 9796-2 schemes 2 and 3 (which use an ad-hoc mask generation function that concatenate several fixed-width hashes). – fgrieu Nov 28 '13 at 14:13

I don't know if that counts, but authors of recently selected SHA3 function Keccak mention its ability to perform Full Domain Hashing:

Variable output length hashing is an interesting feature for natively supporting a wide range of applications including full domain hashing [...]

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.