# Hash of a ciphertext

Would hashing a ciphertext (so $$H(Enc(pk,m))$$) compromise it in any way if both schemes are secure by themselves? This doesn't seem to be the case but I couldn't find a definitive answer.

• What raised this possibility in your mind? – JamesTheAwesomeDude Apr 22 at 0:44
• Consider stream ciphers, consider what you can do if you know that the message contains some "location address to meet" at some known location in ciphertext. Let's say you know the location and want to alter it. Think about how you can alter it in a way the receiver will still accept, i.e. Hash checking passes and all. It is difficult to do with block ciphers but not impossible based on cipher mode used and known plaintext/ciphertext blocks with same key. – Manish Adhikari Apr 22 at 8:22

No.

Any adversary could simply perform the hash themselves and so you are providing them with no additional resources.

• It's theoretically possible (and very dumb) to make a custom hash function and block cipher pair such that for a single particular key and IV and a single-block message the hash's fixed IV ends up reversing the encryption, yet for all other cases each is secure alone (collision-resistant hash, IND-CPA cipher). Utterly useless, and would be very obviously a weird set of designs, but it could be a fun art project or something. – SAI Peregrinus Apr 22 at 14:12
• @SAIPeregrinus: Ye-e-e-es, but semantically I'd argue that it's the design rather than the evaluation of the hash that would constitute the compromise. I'd still like to come to the opening of your exhibition though. – Daniel Shiu Apr 22 at 14:31

Would hashing a ciphertext (so $$H(Enc(pk,m))$$) compromise it in any way if both schemes are secure by themselves? This doesn't seem to be the case but I couldn't find a definitive answer.

I can read this two ways

1. You only reveal the $$H(Enc(pk,m))$$ to the attackers;

• then the attackers need to execute pre-image attack on the secure hash function to find $$Enc(pk,m)$$. This can be executed with some pre-known plaintext since the key is public or can be executed with the generic pre-image attack.

• If the public key is Ind-CPA secure, then the search will fail.

2. You will send your message as encrypt then hash $$C = (Enc(pk,m) \mathbin\|H(Enc(pk,m)))$$

• In this case, the hash doesn't provide any authentication. Since the attacker can calculate an encryption $$Enc(pk,m')$$ of the message $$m'$$ of their choice and hash it to send on their advantage $$C' = (Enc(pk,m') \mathbin\|H(Enc(pk,m')))$$. This is vary dangerous and can have catastrophic results.

• This will not reveal the original message, however, in public-key cryptography, the encryption is free therefore to mitigate either a digital signature is required to a mutual authentication like HMAC.

Note that for many encryption schemes, the cypher text is not deterministic, that is the same clear text, the same key, everything the same, can lead to different cipher text. In that case the hash code may have very little value.

• This begs the question: if the ciphertext generation is deterministic, then what information is leaked by hashing it (and under which conditions?) – Maarten Bodewes Apr 21 at 21:04
• What makes you think that the hash is leaking information, @MaartenBodewes? Don't know all hashes, but at least the SHA-hashes should leak any info. (Whether the ciphertext is deterministic or not.) – Vbakke Apr 21 at 21:17
• The question is "would hashing a ciphertext ... compromise it". You've answered it for the non-deterministic case and you say "in that case the hash code may have very little value". I'm asking about the other case, which your answer seems to indicate is different. – Maarten Bodewes Apr 21 at 21:47
• What kind of value does this hash need to have and why – Manish Adhikari Apr 22 at 8:17