# Is the concept of provably secure hash the same as entropy smoothing hash functions?

Is the concept of provably secure hash the same as entropy smoothing hash functions?

In the tutorial Sequences of Games: A Tool for Taming Complexity in Security Proofs V. Shoup shows us a proof of semantic security of a hashed ElGamal encryption.

In order to get that proof (pag. 9) he put the following condition: we need a family of keyed "hash" functions $\mathcal{H} := \{H_k\}_{k\in K}$ where each $H_k$ is a function mapping $G$ to $\{0,1\}^l$ ($l$ a positive integer and $G$ is a group) such that this family $\mathcal{H}$ is "entropy smoothing".

He tells us that "entropy smoothing" gives us some kind of guarantee that makes it hard to distinguish $(k,H_k(\delta))$ from $(k,h)$, where $k$ is a random element of $K$, $\delta$ is a random element of $G$, and $h$ is a random element of $\{0,1\}^l$.

The author said there are ways to construct entropy smoothing hash functions, but it's just a conjecture that ad-hoc hash functions own this property.

• I'm not 100% sure, but I think the 'entropy smoothing' property is strictly weaker than the standard security guarantees of a cryptographic hash. What I think he's saying is that a standard cryptographic hash is probably entropy-smoothing, but those hashes (e.g. SHA256) don't have formal proofs that they satisfy this property. Feb 14, 2016 at 2:23
• Just to be clear: No, entropy-smoothing hashes and standard cryptographic hashes are not the same. Shoup is saying that it's probably fine to treat them like they are the same, though. Feb 14, 2016 at 2:26
• "entropy smoothing" appears to be the same as "a strong extractor". ​ ​
– user991
Feb 14, 2016 at 3:34

The Leftover Hash Lemma asserts that a strong randomness extractor can be constructed using a family of pairwise independent hash functions. So, if $\mathcal{H}$ in your statement were such a family, you get $(k, H_k(\delta)) \approx (k, h)$.