# Determining susceptibility to frequency analysis

I'm looking to create some tokens using a keyed hash mechanism to represent our individual customers. I was planning on using combinations of the customer's personal information (e.g. H(Firstname,Surname,DOB)) in the token to prevent frequency analysis, but is there some way I can quantify this?

For example, qualitatively I assume that using:

H(Firstname,Surname,DOB,FirstPurchaseDate)

will be more secure than using just:

H(Firstname)

as the latter will render some values of the first name identifiable by frequency analysis given a large enough sample (I will have to open source the protocol for this, so I'm assuming that attacker knows which variables the tokens consist of). I would like know what combinations of variables will render frequency analysis impractical - are there any established techniques for this?

• As far as I know hashes aren't vulnerable to frequency analysis. Do you just want to create different hashes for each customer with some given values like the name, date, etc. so that no two given customers share one hash? – AleksanderRas Aug 23 '19 at 11:04
• Presumably they will be vulnerable in some circumstances? In a more theoretical example, if you were encoding each word in a corpus as an individual hash then you could run frequency analysis on the hashes to work out which hash represented the common words? I'm fairly new to this area though, so happy to be corrected if I'm misunderstanding. – psym Aug 23 '19 at 15:16
• @psym we don't call that frequency analysis, rather something like repeated ciphertexts / hashes. When detection of repetitions needs to be prevented, we use nonces (number used once) / IV:s (initialization values) that differ for each instance. Also, how will you efficiently perform lookups in keyed hashes? You may want searchable encryption, or work in plaintext in RAM but use end-to-end database encryption. – Natanael Aug 23 '19 at 16:00

Whatever parameters you pass in will affect the resulting hashes. If you compute only H(Firstname), then two users with the same first name will lead to the same hash even if they have different surnames.
P.S. Consider letting users simply have a name so that you respect the vast populations of people out there whose names do not conform to the anglophone forename/surname model of names, or other problematic oversimplifications.