I am new in cryptography. I need to compute a hash of a string value represented as follows: $name||i$ where $i$ is an integer.

I use the following pseudocode:

message = []byte(name||i)
hashize = 1536
// Using SHA256 full-domain-hash with 1536 bits
hashed = fdh.Sum(crypto.SHA256, hashize, message)

Here the hash is a vector of integer values. How can I have only one integer that represents the hash of the message?

  • 3
    $\begingroup$ This is a programming question and off-topic here. Use a bignumber library like GNU/GMP or Java's bignum etc. Simply google '"the language you are working" convert bytes to big integer'. byte since most of the libraries works in bytes. $\endgroup$ – kelalaka Oct 7 '20 at 10:50
  • $\begingroup$ Note that there is an accepted, cryptographically specific answer to this question so it seems that it can be on topic. $\endgroup$ – Maarten Bodewes Oct 11 '20 at 12:29

My guess is that the intention is to make an RSA-1536 (or Rabin) signature of name (as a string) and integer $i$ per Full Domain Hash. Thus I answer, form a crypto standpoint, a rephrasing of the question as:

How do I make a full-domain hash of the concatenation of a name (given as a string) and an integer, towards signing these per RSA-FDH.

In a nutshell, my recommendation is to make that as in RSA-PSS, but with a fixed salt.

An implementation of that could be

  1. Express name and $i$ as a bytestring per ASN.1 Distinguished Encoding Rules (DER). This will avoid ambiguities of string concatenation (so that name foo and integer 10 won't have the same hash as name foo1 and integer 0), and normalize the integer (so that integers 00 and 0 will result in the same hash). Formatting could be as a SEQUENCE (tag 16) with name as UTF8String (tag 12) then INTEGER (tag 2). See Burton S. Kaliski's A Layman's Guide to a Subset of ASN.1, BER, and DER (RSA labs, 1993), which is enough for an implementer, except for the UTF8String type.
  2. Apply to the resulting bytestring the EMSA-PSS transformation of PKCS#1v2.2 with SHA-256 hash, MGF1 with SHA-256 hash, $\text{emBits}=1536$, and fixed salt (e.g. 256 bits at zero). Part of that step includes hasing the input bytestring with SHA-256.
  3. Convert the outcome to integer (per big-endian convention); this yields an integer as asked in the question.
  4. Apply textbook RSA signature $x\mapsto x^d\bmod N$ (or the Rabin alternative).
  5. Convert the integer outcome to a bytestring of $\left\lceil\text{emBits}/8\right\rceil=192$ bytes (per big-endian convention), yielding the signature.

Note: when targeting RSA, the combination of 2…5 is precisely signature per RSASSA-PSS of PKCS#1v2.2, and implementations of that should be reusable directly, if they have an input for the salt or for the salt-generating method.

  • $\begingroup$ The implementation itself is off-topic here on crypto-SE, as noted in comment and in our help. $\endgroup$ – fgrieu Oct 7 '20 at 11:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.