# Privacy preserving transformation between hashes

I think this question is related to this other question, but somewhat different.

Let there be a hidden datum $$D$$ that we observe using a hash function $$H_1$$, $$h_1 = H_1(D)$$. There's another hashed value that we get from $$h_2 = H_2(D)$$. Is there a way to pick $$H_1, H_2$$ such that there is another function $$G$$ that we can apply to get $$h_2 = G(h_1)$$, without having to know about the true value of $$D$$? Or is it that the only way to get $$h_2$$ is by application of $$H_2(D)$$?

In my real world problem, $$H_1$$ is already a fixed hash function. But if one were to relax the requirement on $$H_1$$ so that it was allowed to be any kind of encryption function, would that make the above possible? (Assuming that $$H_1$$ being a hash would make it impossible.)

Is there a way to pick $$H_1, H_2$$ such that there is another function $$G$$ that we can apply to get $$h_2 = G(h_1)$$, without having to know about the true value of $$D$$?
One obvious way would be to pick $$H_1, G$$, and then define $$H_2(x) = G(H_1(x))$$. Obvious choices for $$G$$ would be:
• A bijection; this gives an $$H_2$$ with the same cryptographic properties as $$H_1$$
• A cryptographic hash function itself; again, as long as $$H_1$$ is collision resistant and second preimage resistant, so is $$H_2$$ (and you get preimage resistance no matter what $$H_1$$ is).
• Thanks for your answer! What about the case where $H_2$ is also fixed? Is it possible to derive $G$ in that case? Feb 3 at 18:42
• @shadowchris: that depends on what $H_1, H_2$ are; in general, unless they are strongly interdependent, it is unlikely... Feb 3 at 18:45