# Is it secure to send the hash along the message without encryption?

Lets suppose Alice send to Bob a message $M$ along with its hash value say $H$ which is calculated using SHA3 algorithm. It is sent on the network where it got read by Eve and she does not make any changes to the message $M$, she will just read the message.

How Bob will come to know that the message has been read, if the message hash value matches with the sent hash value since the has not made any changes to the message ? What if Eve changes the message ? If the message is not encrypted then this algorithm is not secure. Is it ?

• If some unauthorized can see our message then where is security in it ??? – june Feb 24 '16 at 7:19
• Ya I have seen this example but here if third person alters the message then only receiver will get to know right?? Suppose if someone is sending some data which is not to be seen by anyone except the authorized person but if someone in between can see the message then how will receiver come to know this. I just want to know that before applying SHA3 message should be encrypted ?? – june Feb 24 '16 at 7:29
• So u mean confidentiality of a message is not a major concern here. It mainly focuses on the integrity and authenticity of the message. – june Feb 24 '16 at 7:39
• SHA-3 is a cryptographic hash. On its own it does not even prove authenticity, never mind give confidentiality. – otus Feb 24 '16 at 7:56

Your question is a bit confused and is not about cryptography (security of the algorithms) but more about the usage of these algorithms.

Lets try to make things clear for you.

First there are 3 properties in the security :

• Integrity = only the authorized users can modify the information.
• Confidentiality = only the authorized users can access the information. Here the information is in plain view.
• Authentication = Proof of the identity of the content/sender (sort of proof of identity), be sure to not mistake it with identification.

Each one is guaranteed by a kind of algorithm (simple version) :

• Hashing function (SHA3...) $\implies$ Integrity.
• Encryption algorithm (AES...) $\implies$ Confidentiality.
• Signature scheme (Message Authentication Code...) $\implies$ Authenticity.

The design, security, flaws etc of theses algorithms are discussed here while there secure usage is rather discussed on Security StackExchange.

Now back to your question with our usual love triangle. Alice want to send a message $M$ to Bob, to prove that the message is not modified, she also send Bob the hash of the message $h = H(M)$

Remark : when you study such exchanges, you first assume that the algorithm you use are perfectly secured, you do not need to go into details of which one to use. Think generic !

Alice ------> Eve -----> Bob
M,h        M,h


As $M$ is not encrypted, Eve (who is listening) can read it.

If Eve changes the message with $M'$.

Alice ------> Eve -----> Bob
M,h       M',h


Then we have 2 possibilities :

$H(M') \neq h$ : Bob knows that this is not the message he was supposed to get.

$H(M') = h$ : Alice successfully find another Message that matches the hash, Bob is tricked.

For the sake of this exercise, we will consider $H$ to be secure : we can't find in a reasonable time $M, M'$ such as $M \neq M'$ and $H(M) = H(M')$ (at the moment SHA3 is considered so). How can Eve make sure that Bob is tricked every time ? Well she just needs to change the hash $h$ such as $H(M') = h'$ :

Alice ------> Eve -----> Bob
M,h       M',h'


Bob computes $H(M') = h'$ and is tricked. Therefore No, your algorithm can be considered as not secure from at least an Integrity point of view.

From a confidentiality point of view now, if the message is send without encryption, obviously, anyone can read it. Hash won't provide you any security here.

What if the message is encrypted ? As long as Eve does not have the knowledge of the encryption key (under the assumption that the encryption algorithm is secure), she will not be able to read it but that is not the use of a hashing function (such as SHA3).

• A hash by itself does not guarantee integrity, if the attacker can modify the hash value together with the message. – Paŭlo Ebermann Feb 24 '16 at 20:39
• ya if attacker can modify both the message and its hash value then how will receiver come know that this is an altered message?? Since at the receiver side both the hashes will match. – june Feb 25 '16 at 4:33
• If Eve can modify both the message and its hash value then how will Bob come know that this is an altered message?? Since at the receiver side both the hashes will match @Richie Frame – june Feb 26 '16 at 5:36
• @june : ​ In that case, Bob won't "come know that this is an altered message". ​ ​ ​ ​ – user991 Feb 26 '16 at 5:58
• ya right so where is security here? Is it possible to alter the hash value? – june Mar 3 '16 at 5:41