Privacy preserving transformation between hashes

Question

I think this question is related to this other question, but somewhat different.

Let there be a hidden datum $D$ that we observe using a hash function $H_1$, $h_1 = H_1(D)$. There's another hashed value that we get from $h_2 = H_2(D)$. Is there a way to pick $H_1, H_2$ such that there is another function $G$ that we can apply to get $h_2 = G(h_1)$, without having to know about the true value of $D$? Or is it that the only way to get $h_2$ is by application of $H_2(D)$?

In my real world problem, $H_1$ is already a fixed hash function. But if one were to relax the requirement on $H_1$ so that it was allowed to be any kind of encryption function, would that make the above possible? (Assuming that $H_1$ being a hash would make it impossible.)

Answer 1

Is there a way to pick $H_1, H_2$ such that there is another function $G$ that we can apply to get $h_2 = G(h_1)$, without having to know about the true value of $D$?

One obvious way would be to pick $H_1, G$, and then define $H_2(x) = G(H_1(x))$. Obvious choices for $G$ would be:

• A bijection; this gives an $H_2$ with the same cryptographic properties as $H_1$

• A cryptographic hash function itself; again, as long as $H_1$ is collision resistant and second preimage resistant, so is $H_2$ (and you get preimage resistance no matter what $H_1$ is).