I am looking for practical constructions for Full Domain Hash.

I have read Random Oracles are Practical by M. Bellare and P. Rogaway, the construction suggested on page 8, under "Uniformity: a technicality", but it's unclear whether that is producing a full domain hash, or just ensuring the message is well-formed using an existing hash function.

I haven't found any other information regarding full domain hash constructions.

  • $\begingroup$ Full Domain Hash practice that I'm aware of includes RSASSA-PSS as in PKCS#1v2; and ISO/IEC 9796-2 schemes 2 and 3 (which use an ad-hoc mask generation function that concatenate several fixed-width hashes). $\endgroup$
    – fgrieu
    Nov 28, 2013 at 14:13

1 Answer 1


I don't know if that counts, but authors of recently selected SHA3 function Keccak mention its ability to perform Full Domain Hashing:

Variable output length hashing is an interesting feature for natively supporting a wide range of applications including full domain hashing [...]


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.