We expect the cryptographic hash functions look sort of random (completely undefined). We expect them to have relatively well-distributed output. If a cryptographic hash function has finite or no output on any value on the range, I'll be surprised. The basic requirement for hashing is the collision resistance and this requires nothing beyond that.

One, however, can design one by using any secure existing cryptographic hash function that doesn't produce some outputs. Consider the SHA256 that has classical generic 256-bit pre-image and secondary pre-image resistances and 128-bit classical generic collision resistances. Now consider a new hash function SHA256x defined as:

$$\operatorname{SHA256x}(m) = 1\mathbin\| \operatorname{SHA256}(m)$$

The SHA256x has 257-bit output, however, the values $0\mathbin\|\{0,1\}^{256}$, i.e. values starting with zero, never occur. It has the same resistance as SHA256.

We expect the cryptographic hash functions look sort of random (completely undefined). We expect them to have relatively well-distributed output. If a cryptographic hash function has finite or no output on any value on the range, I'll be surprised. 

The basic requirement for hashing is the collision resistance and this requires nothing beyond that.

• Collision-resistance implies second-preimage resistance, and
• second-preimage resistance implies preimage resistance, this one a bit tricky to prove sine relying on how much hash function compresses the message space. See, Cryptographic Hash-Function Basics by P. Rogaway and T. Shrimpton, 2004 for details.

One, however, can design one by using any secure existing cryptographic hash function that doesn't produce some outputs. Consider the SHA256 that has classical generic 256-bit pre-image and secondary pre-image resistances and 128-bit classical generic collision resistances. Now consider a new hash function SHA256x defined as:

$$\operatorname{SHA256x}(m) = 1\mathbin\| \operatorname{SHA256}(m)$$

The SHA256x has 257-bit output, however, the values $0\mathbin\|\{0,1\}^{256}$, i.e. values starting with zero, never occur. It has the same resistance as SHA256. Of course, such construction has no value at all, other than pedagogically.

We expect the cryptographic hash functions look sort of random (completely undefined). We expect them to have well-distributed output. If a cryptographic hash function has finite or no output on any value on the range, I'll be surprised.

One, however, can design one by using any secure existing cryptographic hash function. Consider the SHA256 that has classical generic 256-bit pre-image and secondary pre-image resistances and 128-bit classical generic collision resistances. Now consider a new hash function SHA256x defined as:

$$\operatorname{SHA256x}(m) = 1\mathbin\| \operatorname{SHA256}(m)$$

The SHA256x has 257-bit output, however, the values $0\mathbin\|\{0,1\}^{256}$ never occurs. It has the same resistance as SHA256.

We expect the cryptographic hash functions look sort of random (completely undefined). We expect them to have relatively well-distributed output. If a cryptographic hash function has finite or no output on any value on the range, I'll be surprised. The basic requirement for hashing is the collision resistance and this requires nothing beyond that.

One, however, can design one by using any secure existing cryptographic hash function that doesn't produce some outputs. Consider the SHA256 that has classical generic 256-bit pre-image and secondary pre-image resistances and 128-bit classical generic collision resistances. Now consider a new hash function SHA256x defined as:

$$\operatorname{SHA256x}(m) = 1\mathbin\| \operatorname{SHA256}(m)$$

The SHA256x has 257-bit output, however, the values $0\mathbin\|\{0,1\}^{256}$, i.e. values starting with zero, never occur. It has the same resistance as SHA256.