The question is about site-to-site transmission where the recipient needs to decrypt the incoming data.

What method is more secure and make it harder to decrypt, Hash-Then-Encrypt or Encrypt-Then-Hash?

  • 1
    $\begingroup$ Related: crypto.stackexchange.com/questions/202/… $\endgroup$
    – MCCCS
    Sep 8, 2018 at 9:23
  • 5
    $\begingroup$ Once you have hashed the data even you can't recover it without knowing the plaintext. What are you trying to achieve with the hashing part? Authenticity? Integrity? $\endgroup$ Sep 8, 2018 at 9:44
  • 1
    $\begingroup$ @R1w, if the receiver needs to decrypt it, use authenticated encryption. If the receiver does not need to decrypt, then a plain hash or a MAC or a signature solves the problem, depending on what needs to be verified. $\endgroup$
    – otus
    Sep 8, 2018 at 12:09
  • 2
    $\begingroup$ @R1w, you cannot decrypt hashed data. The solution for that problem is authenticated encryption, e.g. AES-GCM or ChaCha-Poly1305. $\endgroup$
    – otus
    Sep 8, 2018 at 12:20
  • $\begingroup$ Thank you @apaderno for edit suggestion $\endgroup$
    – R1w
    Apr 1 at 10:31

1 Answer 1


Hash-Then-Encrypt or Encrypt-the-Hash?

Traditionally this means in (a)symmetric encryption one of the following:

$$C=E_K(M\parallel H(M))$$ $$C'=E_K(M)\parallel H(C')$$ $$C''=E_K(M)\parallel H(M)$$

The first scheme is subtly insecure, as can be seen in this answer.
The second scheme blatently provides no extra authentication because an attacker can just go ahead and change the ciphertext and because the hash function is public, re-compute the hash value.
The third scheme is also insecure because it leaks information about $M$, in particular if you have a guess for what $M$ could be, you just compute $H(M)$ and check if it matches with the provided value.

From your comments it sounded like you instead meant the following two schemes:

$$C=E_K(H(M))$$ $$C'=H(E_K(M))$$

but note that neither scheme is actually functionally correct as an encryption scheme because given $H(M)$ it is in general hard and a lot of guesswork to recover $M$ and so the intended recipient can't actually decrypt the message, even with the key.

The question is about Sit-To-Site Transmission where the recipient needs to decrypt the incoming data.

As otus rightfully noticed in the comments what you want in this case is actually authenticated encryption where you, the sender, encrypt some piece of data, e.g. using AES-GCM and then the recipient uses knowledge of the same key you used to decrypt the data. You may also want to note that chances are you actually don't want to deal with AES-GCM itself yourself, but you probably want to have "simply" a secure transmission channel between your sites, which is exactly what Transport Layer Security (TLS) is designed to do. If you have a shared key at the two sites, you can easily use one of the PSK cipher suites for TLS and if not and you only have (authentic) public keys of the other site, you can use the more standard signature-based key exchanges.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.