I have read that output that varies by key size or file size can leak information. So if it should produce fixed size then what is the scenario if it produces fixed range?

By fixed range I mean that for example, by hashing the word "hello" or by hashing 100 MB file produces the length not more than 320 digits long typically rendered as a hexadecimal number. In other words, 320 digit long is the maximum size irrespective of the input length.

So what would be the security issues in this case? Will it create a problem or is it okay? In this case is there any way that attacker can distinguish between various input size?


closed as unclear what you're asking by Squeamish Ossifrage, Maarten Bodewes Mar 30 at 20:29

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • $\begingroup$ Please attack a link to where you read that "output that varies by key size or file size can leak information" $\endgroup$ – Baby desta Mar 30 at 13:28
  • $\begingroup$ "... varies by key size" - there is typically no key involved with a plain cryptographic hash function. I suspect that hashing and encryption are being confused here. Are you sure the place where you saw this mentioned was talking about hashing and not encryption? Hash functions are typically defined as compressing an arbitrarily large input into a fixed-length output. $\endgroup$ – Ella Rose Mar 30 at 13:29
  • $\begingroup$ I think he meant hash-size, not key size. $\endgroup$ – Baby desta Mar 30 at 13:31
  • $\begingroup$ Without clarification I guess that Baby desta's guess is the best one, but the second section completely wrong foots me. Please explain in other words what exactly you mean with "fixed-range". Do you mean a value that is between [0..N) where N may not be a power of two? Or do you mean a range of bits of (0..L] where L is 320 * 8 in your example? $\endgroup$ – Maarten Bodewes Mar 30 at 20:29
  • $\begingroup$ So how does the output size of the hash depend on the input size anyway? What kind of hash function are you using? Normal crypto hashes produce a specific output size (in bits / bytes) only. $\endgroup$ – Maarten Bodewes Mar 31 at 16:23

I am assuming your question is that you want to know if a hash function which is of fixed-size hash is more secure than based on fixed-range hash is more secure.

Even if the hash is of a fixed range, whether it is secure or not depends on the hashing algorithm. Take for example, the following hash function:

$hr$ where the output is a SHA-512 of the input message except that if the hash has leading zeros, they are cut out of it.(For example: if $\operatorname{SHA-512}(x) = \mathtt{0000EA34....}$, then $hr(x) = EA34...$). The maximum length of the hash is the length of the hash of SHA-512.

This fixed-range hash function is completely secure as long as SHA-512 is secure.


Not the answer you're looking for? Browse other questions tagged or ask your own question.