# Why aren't hash values for “nothing” (empty) defined as all zeros?

Any decent hash algorithm will produce basically "random like" values for any given input including the empty input. For example MD5 produces d41d8cd98f00b204e9800998ecf8427e on an empty input.

I wonder, however, why the MD5 algorithm wasn't defined to have a final step where the output is XORed with d41d8cd98f00b204e9800998ecf8427e. This should not affect the cryptographic strength of the hash algorithm, and it would have the convenient property that a hash of all zeros represented a zero input.

Would it simply just because adding that step would slow the hash down a bit?

• why would that be a convenient property? – Richie Frame Aug 30 '18 at 4:06
• @RichieFrame That's the exact first sentence of my answer :P – Maarten Bodewes Aug 30 '18 at 4:09
• Something presumably maps to the all zero hash (though I assume no one has found an example yet). So if something is going to then why not have this property?. – waterjuice Aug 30 '18 at 5:10
• Its also occurred to me that perhaps you would want to reserve testing an all zero hash for some kind of error condition (eg didn't even perform the hash) rather than what the input was. Given the extraordinary unlikelihood that any real input would produce all 0 hash you could fairly safely assume that if you were given all zero as a hash that was an error of some sort – waterjuice Aug 30 '18 at 5:11

We want a hash to model a random function from the set of bitstrings (up to a length limit) to the set of bitrings the length of the hash. And making what's considered would be an exception to that model.

Why would that be a convenient property? It would be pretty annoying if I would test an empty string input, hash that and then XOR it with a value. I would get the same value back. You want the output of a hash function to seem random; getting a value of zero is not what you want at all. You don't want any exceptions to the output of the hash function.

Imagine a crypto currency that requires the first $x$ number of bits to be set to zero for a crypto coin to be mined. You could just input the empty string to be rich beyond belief.

The only thing worse from having an empty string result in $n$ zero valued bytes is to have $n$ zero valued bytes return $n$ zero values bytes. Because in that case $H(0^n)$ would equal $0^n$ but $H(H(0^n))$ would as well, to infinity and beyond.

This would be called a cycle of 1 length; hash functions should never enter a cycle (in practice) when hashing the output of previous hashes. Of course, the hash function would not be considered secure anymore: $H(x) = x$ is called a pre-image and secure hash functions should be secure against pre-image attacks.

• That said, it might stop length extension attacks ... any final calculation probably does. – Maarten Bodewes Aug 30 '18 at 4:08
• I'm not sure what you mean in the first paragraph. Its not the same value anyway. The input is an empty string (ie 0 bytes), the output is 128bits of zero. Regarding the second point, obviously you wouldn't make a crypto currency like that! You could just as easily specify the requirement as the first number of bits to be set to 1. – waterjuice Aug 30 '18 at 5:07
• I guess the answer of fgrieu is what I was trying to show in the first section. You don't want any exceptions. – Maarten Bodewes Aug 30 '18 at 13:19
• Re. your last sentence. Very interesting. Can this be predicted and at what point, or is it hard (mathematical definition of hard)? I've seen it with Pearson hashes and you can get into a self referencing loop /cycle of some length within the lookup table. – Paul Uszak Aug 30 '18 at 13:44
• No, minimum hash cycles can certainly be estimated (precise calculation is tricky if the output is indistinguishable from random, right?). Design docs of cryptographic hashes (which a Pearson hash certainly is not) often have security statements that estimate the cycle count. The Pearson hash seems to have a very small state and output size; you can assume such hashes will enter a cycle pretty quickly even if the block calculations are relatively advanced (which, for a Pearson hash, they are of course not either :P ). "cycle hash" search gives me 4 pages of content on this site! – Maarten Bodewes Aug 30 '18 at 13:52