This may be a very basic question.

I know that symmetric key algorithms use the same key to encrypt and decrypt plaintext and ciphertext.

However, it seems that hash functions are often classified as symmetric key cryptography.

Even though the key is not used in the hash function, from what point of view can it be classified as symmetric key cryptography?

  • $\begingroup$ If the question is not restricted to collision resistant hashing, then there are primitives like universal hashes that are often used as keyed primitives (e.g.: building a message authentication code scheme from a polynomial hash). $\endgroup$ Jan 11, 2023 at 11:00

3 Answers 3


From what point of view can hash functions be classified as symmetric key cryptography?

  1. Hash functions do not use public/private key pairs, thus are not asymmetric cryptography (though they are historically motivated by asymmetric cryptography). So they belong either to symmetric cryptography, or to another kind.
  2. Many hash functions, including some of the first ones, are built on top of a (specialized) block cipher, turned into a one-way compression function by some fixed construction (e.g. Davies–Meyer), then used to form a hash per some iterated construction (e.g. Merkle–Damgård). Block ciphers are part of symmetric cryptography.
  3. The above combination Davies–Meyer + Merkle–Damgård is the basis of e.g. MD5, SHA-1, SHA-256. In this, the plaintext acts as the key of the block cipher. A first-preimage attack against the hash is akin to trying to find a key that matches the hash/ciphertext, and the known Merkle–Damgård IV/plaintext. That analogy works even better if we fix the length of the ciphertext such that there's a single round. So this attack is close to a key recovery attack in a known message setup, which is a classic of symmetric cryptography.
  4. More generally, the attacks on common hash functions, especially those built from a block cipher, use techniques (e.g. differential cryptanalysis) similar to those on ciphers of symmetric cryptography.
  • 1
    $\begingroup$ You can also turn any hash function into a symmetric key encryption with a Feistel network, right? So there's a fairly tight equivalence also. $\endgroup$
    – Sam Jaques
    Jan 13, 2023 at 8:27

I don't think hash functions alone are considered symmetric cryptography, but you can use hash function in HMAC construction (keyed hash) and in that case, you use same key for computing HMAC tag and for verifing them. But hashes are used to provide integrity where as MACs are for authenticity (related but distinct), so it functions as symmetric cryptography in a way.

  • $\begingroup$ So, hypothetically, give a key, a plaintext, and a cipher what is the correct application of a hash and an HMAC? HMAC of the plaintext, hash of the ciphertext? $\endgroup$
    – Sammitch
    Jan 11, 2023 at 22:58

During the SHA-3 competition the so-called Sponge Mode was invented which permits to construct hash functions with an arbitrary length input and output. Also, the Sponge designers have proven that a Sponge instantiated with a random permutation is indistinguishable from a random oracle up to a certain number of calls, see this paper.

Nowadays, sponge mode has become the preferred way to construct new hash functions. Unfortunately, it is impossible to construct a true random permutation. As remedy, one usually constructs a cryptographically secure symmetric keyed permutation and instantiates it in sponge mode.

  • 3
    $\begingroup$ How does this answer the question? $\endgroup$
    – Maeher
    Jan 12, 2023 at 15:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.