# Can I use RSA as hash function?

My end goal is to have an encryption function $$e$$ and a hash function $$H$$ such that for all m we have: $$H(e(m)) = e(H(m))$$

This would work if we use RSA encryption along with RSA "hash", using a different public key. I don't mind the fact that there would be one specific person (who created the private/public key for the hash) that would be able to reverse the "hash".

So my question is can I use RSA as a hash function? I still need all the other properties of hash functions, I just don't mind if a specific person can reverse it.

Or, would there be another hash/cipher pair that would satisfy $$H(e(m)) = e(H(m))$$?

I have looked into fully homomorphic encryption but it does not seem to help.

• Are you expecting single "block" messages? It is weird to have encryption and hash have the same signature. As regards the RSA hash, single block message would not have collisions (and so second preimages), so only preimage resistance remains which is obviously expected to be hard. – Fractalice Jul 28 '20 at 14:37
• @Fractalic I am expecting single "block" messages. Basically I want to prove to different people a and b that one is receiving the hash of what the other is receiving. The scheme currently in place is using SHA256, but I am considering changing it to be able to to this "proof". – Fred Jul 28 '20 at 15:40
• Sponge construction can use permutations, however, I cannot deal with its security... – kelalaka Jul 28 '20 at 16:28
• Well, for your purpose you could use a zero-knowledge proof. You could send one person $c=e_k(m)$ and prove the other that you possess $k$ such that $H(e_k^{-1}(c)) = h$ and provide $h$. – Fractalice Jul 29 '20 at 8:49
• @Fractalic This might be stretching it, but since I'm not very familiar with ZNP, what type of ZNP would work best here? Would you have some references I could dive into? – Fred Jul 29 '20 at 16:19