I have rather simplistic understanding of cryptography, so I have to beg a pardon in advance if the question has internal contradictions.

Imagine data $A$ with a hash $hashA$. This data is encrypted with private key $K$ to get data $E$ and the hash of the encrypted data is $hashE$.

  1. Are there encryption method and hashing method, which will allow to verify, given $hashA$, $hashE$ and $K$, that $hashE$ is indeed a hash of “A encrypted with K”?

  2. How secure could that algorithm be against attempted forgeries, i.e. someone having access to $A$ creating $E$ and $K$, so that $hashA$, $hashE$ and $K$ are correct in sense of $1$, but $E$ is not “A encrypted with K”?

Clearly the identity hash $(hash(x)=x)$ works, but I'm more interested in hashes which are significantly smaller than the original data.

  • 1
    $\begingroup$ You're encrypting with the private key? What encryption scheme are you using? $\endgroup$ – pg1989 Nov 30 '13 at 21:50
  • $\begingroup$ The question if there is any encryption / hash pair which will make it work, there is no specific scheme I have in mind at the moment. $\endgroup$ – Kamal Dec 1 '13 at 9:46
  • $\begingroup$ Probably there is no way to achieve unforgeable hashes. The reason is, that you would need some kind of structure preservation over the schemes, but cryptographic hashing and symmetric encryption both "destroy all structure", s.t. you can only check for equal inputs and nothing else. So any kind of relation or structure of corresponding plaintext and ciphertext will not be preserved by the hash function. Btw, there is no "identity hash", because hash functions are defined as arbitrary length input/fixed length output functions(even non-crypto hash functions). $\endgroup$ – tylo Dec 2 '13 at 13:40
  • $\begingroup$ Tylo, thanks for the input. I agree it's unlikely full security can be achieved this way, so I'm looking towards partial security, where forgery would be merely complicated not impossible. It seems to me that "destroying all structure" property can be still hold, but because of some interplay between encryption method and hashing method we could draw an inference mentioned in 1. Well, clearly my intuitiin in crypto is rather weak. $\endgroup$ – Kamal Dec 2 '13 at 19:17

A generic construction could be something like this:

$\def\Enc{\operatorname{Enc}}$ Take a simple hash function $H$ and encryption function $\Enc_K$.

Then define $E = (\Enc_K(H(A)), \Enc_K(A))$ as the encryption, $hashA(A) = H(A)$ and $hashE(x,y) = x$.

Then we have $hashE(E) = \Enc_K(H(A))$, which of course is easy to check against $H(A)$, given $K$.

Of course, this in no way satisfies your unforgability requirement: Only someone with access to both $E$ and $K$ can check if the hash part of $E$ matches the rest of it.

| improve this answer | |
  • $\begingroup$ Dear Paulo, thanks for your answer. As you state yourself, this solution, while cleary satisfying 1, has zero security in sense of 2. I was intererested in comparing various approaches to find the most secure in this sense. $\endgroup$ – Kamal Dec 1 '13 at 22:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.