# Verifying the integrity of ciphertext using the cleartext hash?

I want to be able to verify the integrity of a ciphertext by providing the cleartext hash, for this to work it would need to:

$$hash(crypt(cleartext)) = f(hash(cleartext))$$

Where $f$ is an arbitrary function mapping the cleartext hash to the ciphertext hash.

Is there such a pair?

Update: I'm trying to prove the integrity to the receiver while delaying the key exchange until I'm ready to commit (send him the decryption details). The hash that proves the integrity comes from another source entirely.

• What do you mean by "integrity of the ciphertext"? (I notice you say "integrity" instead of "authenticity".) Why can't you just provide the hash of the ciphertext? – user991 Dec 20 '11 at 19:49
• Because I (A) want to be able to send the encrypted payload to the B, previously received from a C. B receives an integrity hash from C, and B needs to be sure that the cleartext he will get from decrypting the ciphertext A provided him with is indeed what he needs. If C were able to provide the ciphertext hash that means that C could also provide B with the key, which is not my goal. – cdecker Dec 20 '11 at 21:15

There really isn't such a function $f$; encryption algorithms attempt to generate what looks like random bitstrings (at least, it looks that way to anyone who doesn't know the key), and because the plaintexts and the ciphertexts look unrelated, their hashes are also going to look unrelated.