Consider E - encryption function and H - function calculating hash of message. Is there any E, H for which for message M:

H(E(M)) = H(M)
  • $\begingroup$ Do you want this to hold for all messages? If so this would probably imply E to be the identity function. $\endgroup$
    – SEJPM
    Jan 9, 2018 at 10:47
  • 1
    $\begingroup$ If E is not the identity function (and, in particular, if it's practical to find a message M such the E(M) ≠ M), then H cannot be collision resistant. $\endgroup$ Jan 9, 2018 at 12:11

1 Answer 1


As SEJPM notes in the comments, this is trivially achieved by making $E$ the identity function, such that $E(M) = M$ for all $M$.

If $E$ is not the identity function (and, in particular, if it's practical to find a message $M$ such the $E(M) ≠ M$), then $H(E(M)) = H(M)$ would be a collision attack on $H$.

Normal cryptographic hash functions are supposed to be collision resistant, so for such hash functions $H$ there cannot be any such function $E$ (at least, none that is practically computable and distinguishable from identity), or else the hash is broken.

But I suspect what you're really looking for is something else, such as $H'(E(M)) = H(M)$, where $H'$ and $H$ are two different hash functions. This is easy to achieve by defining $H$ as $H(x) := H'(E(x))$ or, if $E$ is invertible, by defining $H'$ as $H'(x) := H(E^{-1}(x))$. However, defining $H$ (or $H'$) like this does mean that if computing $E = E_K$ requires some secret key $K$, then the same key will also be needed to compute at least one of $H$ or $H'$.

What if we wanted to have $H'(E_K(M)) = H(M)$, where neither of $H$ and $H'$ depend on the key $K$? In that case (assuming the $H$ isn't constant, and in particular that an attacker can choose two messages $M_0$ and $M_1$ such that $H(M_0) ≠ H(M_1)$) $E$ cannot be an IND-CPA secure encryption scheme, and thus cannot be semantically secure. Semantic security is commonly considered the minimum baseline requirement for a secure modern encryption scheme (although there are some weaker but still useful security properties, such as Rogaway and Shrimpton's DAE security), so by that definition, even $H'(E_K(M)) = H(M)$ isn't achievable if $E$ is supposed to be secure (and $H$ is distinguishable from a constant function).


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.