I'm writing a function to act as a cryptographic hash of a number within a range that returns another number of the same range. The catch is that the result needs to have certain properties. I run a simple test for these properties and call the function recursively if the test fails. Naturally this raises a red flag for a timing attack, however, the test is performed on the result of a hash only. Everything preceding the hash takes exactly the same amount of time regardless of input.
My question is, is this a harmful leak of information? Here's the function in question.
def numhash(num, maxnum): num = sha256(str(num)).hexdigest() # calculate sha256 of string version of number num = int(num, 16) % maxnum # convert this to an integer and mod it by the top bound of the range (exclusive) if bin(num).count('1') % 2: return numhash(num + 1) # check for an even number of 1 bits in the number, reject and try again if true. This is where the timing issue is caused return num
Note: I'm aware of the slight bias towards lower results and high collision rate. This is acceptable.