On this question https://stackoverflow.com/questions/5889238/why-is-xor-the-default-way-to-combine-hashes a couple of the answers say that xoring is a bad/insecure choice for combining hashes. However, most of them say that in regards to xoring two identical hashes.

If I want to combine a Keccak-256, Skein-256-256, Blake2b-256, and Groestl-256 hash, would it be more secure to concatenate parts of the hash, or to xor the hashes together?

  • $\begingroup$ It would be best to keep them as distinct hashes. You may later introduce even more hash functions without changing any existing hashes. So instead of just concatenating (and not hashing the composite), you can do [(hash_id, hash(message))], a list of hashes with a per-hash-function identifier. $\endgroup$
    – cypherfox
    Commented May 9, 2018 at 9:02

1 Answer 1


The answer is (as always): It depends. If you want pseudorandomness, then XOR is a good combiner (actually even optimal). However, if you want collision resistance then XOR is a really bad combiner because afaik you cannot show that collision resistance of the two hash functions implies collision resistance of the combiner. If you think about it, a collision for that combiner does not imply a collision for either of the hash functions. The same argument applies to second-preimage resistance. On the contrary, for the concatenation combiner a collision of the combiner contains a collision for both hash functions.

For one-wayness the situation is a bit more complicated. However, you cannot use a preimage finder for the combiner to find preimages for one of the hash functions...


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.