0
$\begingroup$

If I Generate some key K for the AES algorithm. Encrypt a message M with key K and take the last 64 bits of the result as the hash of M.

Would there be any disadvantages? What if I took first 64 bits of the message rather than the last 64 bits?

$\endgroup$
1
$\begingroup$

Short answer: neither.

I'm going to assume the length of M is 128 bits (one AES block) so we won't be talking about block cipher modes.

A hash is useful to verify the integrity of the message. It is meant to be verifiable either without (plain hash) or with (MAC) a key. In your scenario, it is neither: only someone with the plaintext can compute the hash again (in which case: why encrypt?).

With your proposed solution (either first or last 64 bits), you cannot tell if the ciphertext or plaintext have been altered. The only way would be to decrypt the message and have some way of verifying the validity of the plaintext after decryption.

What you probably want is a message authentication code.

| improve this answer | |
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.