# Does having a hash of the plaintext compromise the ciphertext?

If I have a SHA512 hash of my plaintext, does it weaken or break the encryption of my ciphertext?

• If the hash is attacker-accessible, then this does indeed break security against eavesdroppers (quite literally the weakest attacker model there is), because you can just verify your plaintext guess using the hash w/o any interactions with the encryption or decryption function. – SEJPM Apr 28 '18 at 19:06
• Does it allow the attacker to generate the key? – Homer6 Apr 28 '18 at 19:11
• Have a look at our game overview and take the IND-CPA game without access to the encryption oracle. – SEJPM Apr 28 '18 at 19:41

It could break the security of your plaintext yes.

As secure hashes like SHA-512 are one way it is impossible to regenerate the plaintext $M$ from the hash. However an adversary can try to regenerate the plaintext $M'$, calculate the hash value over $M'$ and compare the result with the given hash. This verification can only succeed if the adversary inputs the correct message. If $H(M') = H(M)$, then $M'$ is the same as $M$ with a high degree of certainty because it is computationally infeasible to find a collision for SHA-512.

Recreation of the message could consist of knowing or guessing the contents and brute forcing the rest. If the adversary has to try more than $2^{128}$ possibilities (with equal likelihood) then the message would be secure as the chance of recreating the original message would be negligible.

Generally we try to make message confidential even if the message just contains a single bit 0 or 1. This can be achieved by using encrypt-then-MAC or by using an authenticated mode such as GCM.

If you're using a secure symmetric cipher then knowing the hash over the plaintext cannot leak the key. The key should not be compromised even if both the plaintext and ciphertext are known.

• Comments are not for extended discussion; this conversation has been moved to chat. – e-sushi Apr 29 '18 at 9:41

Yes, having a hash of the plaintext available weakens the security of your encryption scheme.

Semantically secure encryption schemes have the guarantee that ciphertexts should be indistinguishible, regardless of what plaintext is encrypted. Clearly hashes do not have this property, since they're deterministic for each plaintext.

Assuming that messages are not randomly chosen, an adversary can guess messages, hash them, and check whether or not the hash is correct in order to learn the plaintext for the ciphertext. With only access to the ciphertext, but not a hash of the plaintext, this would be impossible, since a semantically secure encryption scheme does not allow an attacker to guess the plaintext for a ciphertext, as ciphertexts appear to be completely random with respect to the plaintext. The confidentiality guarantee of your system should only rely on the randomness and size of the key used, and not on the randomness of the plaintext, so this scheme is insecure if a hash is provided.

As for whether or not it allows the attacker to generate the key, that depends on the security guarantees of your encryption. As long as the encryption scheme is CPA secure (which is pretty much the weakest level of security that's "acceptable" for an encryption scheme), then one can't recover the key from plaintext and ciphertext.