I need a cryptographic hash function that will hopefully be strong even in 50 years. Performance is not an issue. Calculating and verifying can take a huge amount of time if needed. The size of the hash can be huge too (let's say up to 10MB). Collisions are not a big threat. I mainly want it to be second-preimage-resistant.

Of course I have no problem using one or more existing hashes.

My first thought was:

$h'(x) := h(a_1 \parallel x) \parallel h(a_2 \parallel x) \parallel h(a_3 \parallel x) \parallel \dots$

where $a_n$ are known prefixes. But I don't know how good it is. If $h$ is md4, how hard is it to find a second preimage to $h'$?

Other ideas?

  • 1
    $\begingroup$ if the collision is not a threat then use a 512 bit hash function. That will protect you against classical and quantum attacks. SHA-512, SHA3-512 should be enough for you. $\endgroup$
    – kelalaka
    Jul 11 at 12:38
  • 2
    $\begingroup$ If any attack is found it is not the output size that matters; it's the hash function that gets broken. Creating a hash from e.g. SHA-512 and SHA-3-512 would make more sense as they use rather different methods; it's unlikely that they get broken simultaneously. Early TLS protocols concatenated an MD5 and SHA-1 hash within the signature format, if I remember correctly. $\endgroup$
    – Maarten Bodewes
    Jul 11 at 12:45
  • $\begingroup$ Please check how much is already answered in this answer. I would have closed it as a dupe already if you hadn't excluded collisions. $\endgroup$
    – Maarten Bodewes
    Jul 11 at 12:56
  • $\begingroup$ @MaartenBodewes Thanks. Though it has completely different focus than mine. The author cares mostly about "the original preimage". $\endgroup$
    – ashidc
    Jul 11 at 13:06
  • $\begingroup$ @MaartenBodewes Regarding "it not the output size that matters". I didn't think it does. I just though it is harder to find this preimage. because you need to find one x, so h(a1 || x) == output1 AND h(a2 || x) == output2 $\endgroup$
    – ashidc
    Jul 11 at 13:08

Err, 50 years?

You can't. You're predicting the future. These are also predictions of the future. I truly believe that the flame throwing snow ploughs are right around the corner.

Total future proof security does exists as a concept. One time pads and secret sharing are informationally secure, which means for all time. That's why we still use one time pads for diplomatic messages. Consider this polynomial hash then. But given the earlier link, how do we convince anyone that a security metric of $2^{-32}$ or even $2^{512}$ can't be overcome. I didn't say brute forced, I said overcome. Re-linearisation, the Algomorov technique, parallel quantum computing, mathematical advances and flame throwers demonstrate that we can't see more than a few years into the future. Cough, cough I feel really hot...


"I think there is a world market for about five computers."

-- Thomas J Watson, President IBM.

  • $\begingroup$ I understand of course. Nonetheless, I'd love to have some best-effort solution. If it breaks, it breaks. My life doesn't depend on this. But like I asked, I'd like to understand how can I make a stronger hash, given my constraints, and existing hashes, and flexibility (calculation and validation time, and storage can be huge). $\endgroup$
    – ashidc
    Jul 13 at 18:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.