# Are cryptographic hash functions quantum secure?

I was reading a paper related to post quantum cryptography. It says that RSA, ECC and ElGamal encryption schemes would be obsolete with the advent of quantum computers. But the hash functions can still be secure. I don't understand how one can unilaterally claim this security when hash functions themselves are not based on any hard problems. (I do have the knowledge of Merkel-Damgård and Keccak construction).

Are there hash functions considered secure just because nobody has come up with a quantum algorithm to solve it? Or are there any reduction to any well known hard problem? It there is please explain the reduction.

• Hash functions have so little mathematical structure (as opposed to asymmetric crypto) that it is generally assumed that no specialized quantum algorithm exists for them (same with other symmetric algorithms). Commented Mar 3, 2017 at 13:22
• Remember, Hash functions are a fundamentally different beast. Compare putting a book in a safe to copying the first letter of every page as proof you had the book, then burning it. The first has a way to get the book back, the second doesn't no matter how much resources you may have. A lossy algorithm is difficult to reverse beyond just being mathematically difficult, the actual data to reverse it is permanently gone. Commented Mar 3, 2017 at 17:51
• I do not think the hardness of inverting has anything to do with lossiness, as an inverter is only require to find any valid preimage. Lossiness just adds more valid preimages, what really matters is the lack of (easily identifiable/ usable) structure. Commented Mar 3, 2017 at 20:07
• I'm not an expert, but there is a really good answer on this site that talks about how they are difficult to solve for a valid input due to fanout (it helps to visualise the hash as a series of logic gates). With that, and the boolean satisfiability problem, I'd say they are based on hard problems? Commented Mar 4, 2017 at 9:25
• Can you link to this answer? Regarding your remark, what matters is not being based on a hard problem, but having a polynomial time reduction to a problem that we have failed to break. The Merkle-Hellman cryptosystem was based on an NP-hard problem (the knapsack problem), but it was broken nevertheless, and its insecurity does not have any impact on the NP-hardness of the problem it was based on. Commented Mar 4, 2017 at 13:27

It is a bit dubious to claim that hash functions "are not based on any hard problem": inverting a standard hash function, or finding a collision, is itself a very hard problem.

The point of a reduction is to gather the cryptanalytic effort on a smaller number of hypothesis. The fact that RSA-OAEP is CCA secure under the RSA assumption is not a proof that it is secure, simply an indication that to study its security, it suffices to study the security of the RSA problem. As many other cryptographic primitives can be reduced to the RSA assumption, it saves a considerable cryptanalytic effort.

Now, such reductions usually rely on some nice algebraic properties of mathematical hypothesis, exploiting group structure, self-randomizability, and so on. These properties are common in asymmetric cryptography, because such additional structure is already necessary in the primitives it involves. But in symmetric crypto, on the other hand, such structure is typically avoided. A consequence of that is that you need way smaller primitives (in terms of bit size) and much less computationally expensive operations to achieve a (conjectured) given security level, but you loose the possibility of reducing many symmetric primitives to a small number of hypothesis.

Still, for the most widely deployed block ciphers and hash functions, the cryptanalytic effort that has been invested on studying their security easily matches the effort invested on "generic hypothesis" such as the discrete logarithm or the factorisation, because they are widely used in practice. Therefore, there is no reason to believe that, due to the lack of reductions, inverting SHA256 should be any easier than breaking RSA. In fact, because RSA has so much structure, most experts would probably be way more surprised by an attack that inverts SHA256 than by an attack that breaks RSA. Therefore, the fact that ElGamal and the kind enjoy "reductions" does absolutely not make them more secure - it only establishes links between hardness of different primitives.

That being said, quantum computers are not magical. We cannot say anything for sure about what we can or what we cannot break with them - for all we know, it could be that $$P=NP$$, and that all of cryptography can be broken using a classical computer. But our current knowledge gives us some intuition on the additional power they give over classical computers. And this intuition can be summed up as follow: it seems to give some additional power, but to still fall short on solving very hard problems (say, NP-complete problems) in reasonable time.

Some problems with a special structure (factorization, discrete log) typically fall in the category of problem for which quantum computers would give a very strong speedup, because they can be reduced to the task of finding the period of some function, which seems hard to do with a classical computer, but not with a quantum one. For unstructured problems, quantum computers seem to provide some non-trivial quadratic speedup, via the use of the Grover algorithm. But a quadratic speedup does not give an attack, it simply indicates that the size of the keys should be increased by a factor two to compensate for this speedup.

Hash functions are rather unstructured, so we currently do not see how to get more than a quadratic speedup over a classical computer to attack one. Therefore, we currently conjecture that a hash function with 256 bits of classical security would still have 128 bits of quantum security. For collision resistance, quantum computers provide an even less impressive speedup: the birthday attack gives a $$O(\sqrt{n})$$ attack, and its quantum version seems only to make this attack $$O(n^{1/3})$$. (Note years later: see the comments below by SEJPM and Squeamish Ossifrage for why in reality, this $$O(n^{1/3})$$ cost is a wild underestimate of the true cost of quantum collision search, and why it does actually not even beat the classical $$\sqrt{n}$$-time birthday paradox attack).

• Actually, the quantum-speed-up on collision finding is a widespread, false myth. Commented Mar 3, 2017 at 14:23
• I did not know this article, thank you for sharing it :) If I understand right, the point is that using a quantum computer will not be as cost-effective as using massively parallel classical computers for collision-finding; I was not really looking at speed or cost, but rather at the theoretical complexity of the problem in the classical and in the quantum world. In any case, it strengthens my point and it's always nice to learn something :) Commented Mar 3, 2017 at 14:37
• Actually, security properties of iterated hash functions often can be reduced to security properties of the used compression function. (Or in the case of sponge functions, to the properties of the used permutation.) Commented Mar 4, 2017 at 10:54
• Sure, and it is indeed a very active research field in symmetric crypto - proving indistinguishability, indifferentiability to a random oracle, or collision-resistance of symmetric primitives built on top of "smaller" primitives. But I assumed that it was not the point of OP's question and focused on the case of the underlying fixed size input primitives. Commented Mar 4, 2017 at 11:17
• @SEJPM I don't understand this article, if he is saying that RSA is not threatened by quantum computing what was Mr Rivest talking about in the numberphiles interview? Commented May 15, 2017 at 9:58

Common hash functions are based on combinatorial problems. Very coarsely, (future) quantum computers are claimed to be able to solve combinatorial problems with effort (at worst) $$O(2^{k/2})$$ for $$k$$ unknown bits, versus $$O(2^k)$$ for classical computers. Thus quantum computer do not imply the doom of security of all hashes; at worse, it implies doubling some security parameters.

I trust SHA-512 against all kinds of computers more than I trust SHA-256 against classical ones.

Update, 2024 (6.5 years later): Consensus is still that for combinatorial problems including SHA2 and SHA3, an hypothetical Cryptographically Relevant Quantum Computer would reduce security from $$k$$-bit to no less than $$k/2$$-bit, e.g. for preimage-resistance of a $$k$$-bit hash. And there's no conjectured method approaching this when it comes to collision-resistance of a $$2k$$-bit hash.

security of some symmetric structures can be prove against quantum adversary as well. For example you can see 'Post-quantum security of the CBC, CFB, OFB, CTR, and XTS modes of operation'. SHA3 is based on sponge function which its security has been proved under some assumption against quantum adversary. you can find some of them by just a quick search.

• "You can find some of them by just a quick search", if I were to offer opinion, I think your answer can be instantly improved by linking to a few (relevant) search results. URLs are allowed here! Commented Jun 26 at 11:19

A hash is just a symmetric cipher run in a loop, encrypting the input using a key also from the same input, and often with extra stuff sprinkled in as you go (e.g. prime remainders in SHA-2).

I'm no expert, but whether or not any hash is quantum-resistant boils down entirely to whether or not the symmetric cipher chosen for the hash is.

The SHA-2 cipher is secret (classified), so only the NSA (who invented SHA) know if it's quantum-resistant or not.

• Um, how can the cipher be secret if the entire algorithm is known? Why would a hash rely on a symmetric cipher? Yes, some hashes are and symmetric ciphers and hashes have a lot in common, but does that mean that a hash must rely on an underlying block cipher? Commented Dec 15, 2017 at 16:07
• Hi Maarten. See Merkle–Damgård to learn up on how all modern hash mechanisms are constructed. Once you're clear on how and why they use symmetric ciphers, you can research which one's used in SHA if you like, or if you're good at reverse engineering, maybe you can look at the SHA code and work out which one it is? (I doubt that though - this is NSA-designed - the actual cipher they used is almost certainly classified) Commented Dec 16, 2017 at 22:48
• Merkle–Damgård is not the only method of generating a modern hash; for instance Keccak / SHA-3 is not a Merkle–Damgård hash. Commented Dec 16, 2017 at 23:04
• This is so wrong I don't even know where to start. So, I'll limit myself to passing on the friendly advice to read up on SHA-2 as well as the Merkle–Damgård construction it uses. Related papers are widely available to the general public and — in contrast to your claims — by no means secret or classified in any way. While doing your research, you'll soon notice there is a huge difference between a cipher (aka encryption algo) and a Merkle–Damgård construction. TL;DR: I fully agree with @MaartenBodewes' comments. Commented May 20, 2018 at 19:00
• @AnonCoward Since the cipher is only used internally in SHA-2, it does not have a name. However, when you extract it, you have a cipher called SHACAL-2, which is public. The cipher used may have been based on a cipher which is classified, but the block cipher in SHA-2 is public. Commented Jul 15, 2018 at 3:23