# What is the minimum message length to obtain the full potential of a hash?

Suppose I want to commit to a uniformly picked nonce of fixed length $$n$$ bits without revealing the nonce, so I use a secure hash function $$H$$ mapping messages to digests of length $$d$$ bits. Suppose $$H$$ promises a complexity of $$\sim 2^d$$ for a preimage attack, and $$\sim 2^{d/2}$$ for a collision attack. Suppose $$n$$ is publicly known.

Clearly, at least for the preimage attack, the above promise cannot gain you a complexity of more than $$2^n$$ for $$n, because then you can just try out all $$2^n$$ messages.

My question is: is it considered safe for practical purposes (say, for $$H$$ from the SHA-2 or SHA-3 family) to use $$n=d$$ for obtaining the full or almost full complexity of $$H$$, or should $$n$$ be even greater?

• @kelalaka No, the length of the nonce is supposed to be fixed to n bits. I've edited the question to make that clearer. – Alexander Klauer Jan 12 '19 at 16:13
• could you also name some the practical purposes? – kelalaka Jan 12 '19 at 16:51

If we limit the input size shorter than the output size, it is unlikely that we will find a collision. Consider 128-bit input size, the total inputs are $$2^{128}$$ and even for today technology, it is far to reach for search. The SHAs will map these $$2^{128}$$ different inputs into a much larger space as 224, or to 521-bit. Since we don't know how the values are distributed by these hash functions, we cannot prove it but we can say that it very likely that the values are distinct.