Calculating hash of original message by encoded message

Question

Consider E - encryption function and H - function calculating hash of message. Is there any E, H for which for message M:

H(E(M)) = H(M)

Answer 1

As SEJPM notes in the comments, this is trivially achieved by making $E$ the identity function, such that $E(M) = M$ for all $M$.

If $E$ is not the identity function (and, in particular, if it's practical to find a message $M$ such the $E(M) ≠ M$), then $H(E(M)) = H(M)$ would be a collision attack on $H$.

Normal cryptographic hash functions are supposed to be collision resistant, so for such hash functions $H$ there cannot be any such function $E$ (at least, none that is practically computable and distinguishable from identity), or else the hash is broken.

---

But I suspect what you're really looking for is something else, such as $H'(E(M)) = H(M)$, where $H'$ and $H$ are two different hash functions. This is easy to achieve by defining $H$ as $H(x) := H'(E(x))$ or, if $E$ is invertible, by defining $H'$ as $H'(x) := H(E^{-1}(x))$. However, defining $H$ (or $H'$) like this does mean that if computing $E = E_K$ requires some secret key $K$, then the same key will also be needed to compute at least one of $H$ or $H'$.

What if we wanted to have $H'(E_K(M)) = H(M)$, where neither of $H$ and $H'$ depend on the key $K$? In that case (assuming the $H$ isn't constant, and in particular that an attacker can choose two messages $M_0$ and $M_1$ such that $H(M_0) ≠ H(M_1)$) $E$ cannot be an IND-CPA secure encryption scheme, and thus cannot be semantically secure. Semantic security is commonly considered the minimum baseline requirement for a secure modern encryption scheme (although there are some weaker but still useful security properties, such as Rogaway and Shrimpton's DAE security), so by that definition, even $H'(E_K(M)) = H(M)$ isn't achievable if $E$ is supposed to be secure (and $H$ is distinguishable from a constant function).