Modern hash functions are considered to be efficient to calculate by boolean circuits (i.e their implementation are using bits- operations).

I'm looking for a cryptographic hash function, that can be efficient calculate by arithmetic circuits (i.e they use OR and AND gates (or $+$ and $\cdot$ gates) and work over $\operatorname{GF}(q)$.

After bit of search, I found MASH-1 and MASH-2 constructions, but they seem to include the $\text{xor}$ function that I'm trying to eliminate.


You could try Ajtai's hash function:

What is Ajtai's hash function?

Given a matrix $A \hookleftarrow U(\mathbb{Z}_q^{n \times m})$ and a column vector $\vec{m} \in \mathbb{Z}_d^m$, the hash of the message $\vec{m}$ is given by

$H(\vec{m}) = A\vec{m} \mod q$

If you're not comfortable with linear algebra (and perhaps lattices too) it might be more challenging to implement than something like SHA256.

As for the efficiency, that depends on your definition of "efficient". I doubt it will compete with something like SHA256/SHA512/BLAKE2 for speed; But to be fair, few algorithms will beat BLAKE2.


You will need to take extra care to ensure that the implementation functions in constant time. With bitwise operations, this is significantly easier to accomplish, which is one motivation to use them.

  • $\begingroup$ Thanks! My only problem is that $\vec{m} \in Z_{q}^{m}$ and the input isn't from $\mathbb{F}_q$, can I overcome this problem somehow? $\endgroup$ – user1387682 Aug 22 '18 at 23:16
  • $\begingroup$ @user1387682 I'm not sure I understand the question. The definition for the message to be hashed is a column vector in $\mathbb Z^{m}_d$ rather than $\mathbb F_q$. Or do you mean that you need a hash where the input is from $\mathbb F_q$ rather than $\mathbb Z^{m}_d$? $\endgroup$ – Ella Rose Aug 26 '18 at 15:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.