Can we estimate the loss of entropy when applying a N-bit hash function to and N-bit random input?
$begingroup$
Someone pointed out recently to me that a cryptographic hash function " is not designed as a bijective mapping from N bit input to N bit output".
So if I feed an N-bit cryptographic hash function with N bits of random input, there's a loss of entropy between the input and output of the hash function.
Considering the md5 hash function, is there a way to estimate that loss of entropy? And is this loss cumulative so I could say, if I apply the hash function enough times, I end up with a 50% loss of entropy?
hash entropy
asked Feb 10 at 20:15
Sylvain LerouxSylvain Leroux
1185
$endgroup$
add a comment |
$begingroup$
Someone pointed out recently to me that a cryptographic hash function " is not designed as a bijective mapping from N bit input to N bit output".
So if I feed an N-bit cryptographic hash function with N bits of random input, there's a loss of entropy between the input and output of the hash function.
Considering the md5 hash function, is there a way to estimate that loss of entropy? And is this loss cumulative so I could say, if I apply the hash function enough times, I end up with a 50% loss of entropy?
hash entropy
asked Feb 10 at 20:15
Sylvain LerouxSylvain Leroux
1185
$endgroup$
4
$begingroup$
Possible duplicate of Entropy when iterating cryptographic hash functions. The only reason it might not be a duplicate is because this question asks about MD5 specifically.
$endgroup$
– Ella Rose♦
Feb 10 at 21:22
1
$begingroup$
Possible duplicate of If a SHA256 hash with high entropy is then hashed with one made from low entropy, is the resulting hash higher/same/lower entropy?
$endgroup$
– Squeamish Ossifrage
7 hours ago
add a comment |
$begingroup$
Someone pointed out recently to me that a cryptographic hash function " is not designed as a bijective mapping from N bit input to N bit output".
So if I feed an N-bit cryptographic hash function with N bits of random input, there's a loss of entropy between the input and output of the hash function.
Considering the md5 hash function, is there a way to estimate that loss of entropy? And is this loss cumulative so I could say, if I apply the hash function enough times, I end up with a 50% loss of entropy?
hash entropy
asked Feb 10 at 20:15
Sylvain LerouxSylvain Leroux
1185
$endgroup$
Someone pointed out recently to me that a cryptographic hash function " is not designed as a bijective mapping from N bit input to N bit output".
So if I feed an N-bit cryptographic hash function with N bits of random input, there's a loss of entropy between the input and output of the hash function.
Considering the md5 hash function, is there a way to estimate that loss of entropy? And is this loss cumulative so I could say, if I apply the hash function enough times, I end up with a 50% loss of entropy?
hash entropy
hash entropy
asked Feb 10 at 20:15
Sylvain LerouxSylvain Leroux
1185
asked Feb 10 at 20:15
Sylvain LerouxSylvain Leroux
1185
edited Feb 10 at 20:21
Sylvain Leroux
asked Feb 10 at 20:15
Sylvain LerouxSylvain Leroux
1185
asked Feb 10 at 20:15
Sylvain LerouxSylvain Leroux
1185
asked Feb 10 at 20:15
Sylvain LerouxSylvain Leroux
1185
1185
4
$begingroup$
Possible duplicate of Entropy when iterating cryptographic hash functions. The only reason it might not be a duplicate is because this question asks about MD5 specifically.
$endgroup$
– Ella Rose♦
Feb 10 at 21:22
1
$begingroup$
Possible duplicate of If a SHA256 hash with high entropy is then hashed with one made from low entropy, is the resulting hash higher/same/lower entropy?
$endgroup$
– Squeamish Ossifrage
7 hours ago
add a comment |
4
$begingroup$
Possible duplicate of Entropy when iterating cryptographic hash functions. The only reason it might not be a duplicate is because this question asks about MD5 specifically.
$endgroup$
– Ella Rose♦
Feb 10 at 21:22
1
$begingroup$
Possible duplicate of If a SHA256 hash with high entropy is then hashed with one made from low entropy, is the resulting hash higher/same/lower entropy?
$endgroup$
– Squeamish Ossifrage
7 hours ago
4
4
$begingroup$
Possible duplicate of Entropy when iterating cryptographic hash functions. The only reason it might not be a duplicate is because this question asks about MD5 specifically.
$endgroup$
– Ella Rose♦
Feb 10 at 21:22
$begingroup$
Possible duplicate of Entropy when iterating cryptographic hash functions. The only reason it might not be a duplicate is because this question asks about MD5 specifically.
$endgroup$
– Ella Rose♦
Feb 10 at 21:22
1
1
$begingroup$
Possible duplicate of If a SHA256 hash with high entropy is then hashed with one made from low entropy, is the resulting hash higher/same/lower entropy?
$endgroup$
– Squeamish Ossifrage
7 hours ago
$begingroup$
Possible duplicate of If a SHA256 hash with high entropy is then hashed with one made from low entropy, is the resulting hash higher/same/lower entropy?
$endgroup$
– Squeamish Ossifrage
7 hours ago
add a comment |
1 Answer
1
active
oldest
votes
$begingroup$
Actually, no. If it is a good Hash, you should roughly have $N-k$ bits of output entropy for some $k$ of much lower order than $N$.
The problem arises when the input is much longer than $N$ bits.
One way to estimate the entropy loss of such a Hash applied to $N$ bit inputs is to model it as a randomly chosen function on $N$ bits.
This was first done by Odlyzko and Flajolet. There is a nice review with updated results here
Let $tau_m$ be the image size of the $m$th iterate of the function. The entropy can be related to its behaviour.
If the function is a permutation, $tau_m=2^N$ for all $mgeq 1$ and there is no entropy loss.
Edit: See the comment and link by @fgrieu which is an estimate of what I called $tau_1.$ He is saying that
$$
tau_1approx 2^{128-0.8272cdots }
$$
for $N=128.$
answered Feb 10 at 20:50
kodlukodlu
8,85611329
$endgroup$
3
$begingroup$
Is there any estimate for the $k$?
$endgroup$
– kelalaka
Feb 10 at 21:12
1
$begingroup$
Except for small $N$, the $k$ depends very little on $N$, and for $N=128$ is already very close to its asymptotic value $eta=displaystyle{1over e}sum_{j=1}^infty{j;log_2jover j!};;=0.8272dotstext{bit}$. See this.
$endgroup$
– fgrieu
Feb 10 at 22:14
add a comment |
Your Answer
StackExchange.ifUsing("editor", function () {
return StackExchange.using("mathjaxEditing", function () {
StackExchange.MarkdownEditor.creationCallbacks.add(function (editor, postfix) {
StackExchange.mathjaxEditing.prepareWmdForMathJax(editor, postfix, [["$", "$"], ["\\(","\\)"]]);
});
});
}, "mathjax-editing");
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "281"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: false,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
noCode: true, onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fcrypto.stackexchange.com%2fquestions%2f67217%2fcan-we-estimate-the-loss-of-entropy-when-applying-a-n-bit-hash-function-to-and-n%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
$begingroup$
Actually, no. If it is a good Hash, you should roughly have $N-k$ bits of output entropy for some $k$ of much lower order than $N$.
The problem arises when the input is much longer than $N$ bits.
One way to estimate the entropy loss of such a Hash applied to $N$ bit inputs is to model it as a randomly chosen function on $N$ bits.
This was first done by Odlyzko and Flajolet. There is a nice review with updated results here
Let $tau_m$ be the image size of the $m$th iterate of the function. The entropy can be related to its behaviour.
If the function is a permutation, $tau_m=2^N$ for all $mgeq 1$ and there is no entropy loss.
Edit: See the comment and link by @fgrieu which is an estimate of what I called $tau_1.$ He is saying that
$$
tau_1approx 2^{128-0.8272cdots }
$$
for $N=128.$
answered Feb 10 at 20:50
kodlukodlu
8,85611329
$endgroup$
3
$begingroup$
Is there any estimate for the $k$?
$endgroup$
– kelalaka
Feb 10 at 21:12
1
$begingroup$
Except for small $N$, the $k$ depends very little on $N$, and for $N=128$ is already very close to its asymptotic value $eta=displaystyle{1over e}sum_{j=1}^infty{j;log_2jover j!};;=0.8272dotstext{bit}$. See this.
$endgroup$
– fgrieu
Feb 10 at 22:14
add a comment |
$begingroup$
Actually, no. If it is a good Hash, you should roughly have $N-k$ bits of output entropy for some $k$ of much lower order than $N$.
The problem arises when the input is much longer than $N$ bits.
One way to estimate the entropy loss of such a Hash applied to $N$ bit inputs is to model it as a randomly chosen function on $N$ bits.
This was first done by Odlyzko and Flajolet. There is a nice review with updated results here
Let $tau_m$ be the image size of the $m$th iterate of the function. The entropy can be related to its behaviour.
If the function is a permutation, $tau_m=2^N$ for all $mgeq 1$ and there is no entropy loss.
Edit: See the comment and link by @fgrieu which is an estimate of what I called $tau_1.$ He is saying that
$$
tau_1approx 2^{128-0.8272cdots }
$$
for $N=128.$
answered Feb 10 at 20:50
kodlukodlu
8,85611329
$endgroup$
3
$begingroup$
Is there any estimate for the $k$?
$endgroup$
– kelalaka
Feb 10 at 21:12
1
$begingroup$
Except for small $N$, the $k$ depends very little on $N$, and for $N=128$ is already very close to its asymptotic value $eta=displaystyle{1over e}sum_{j=1}^infty{j;log_2jover j!};;=0.8272dotstext{bit}$. See this.
$endgroup$
– fgrieu
Feb 10 at 22:14
add a comment |
$begingroup$
Actually, no. If it is a good Hash, you should roughly have $N-k$ bits of output entropy for some $k$ of much lower order than $N$.
The problem arises when the input is much longer than $N$ bits.
One way to estimate the entropy loss of such a Hash applied to $N$ bit inputs is to model it as a randomly chosen function on $N$ bits.
This was first done by Odlyzko and Flajolet. There is a nice review with updated results here
Let $tau_m$ be the image size of the $m$th iterate of the function. The entropy can be related to its behaviour.
If the function is a permutation, $tau_m=2^N$ for all $mgeq 1$ and there is no entropy loss.
Edit: See the comment and link by @fgrieu which is an estimate of what I called $tau_1.$ He is saying that
$$
tau_1approx 2^{128-0.8272cdots }
$$
for $N=128.$
answered Feb 10 at 20:50
kodlukodlu
8,85611329
$endgroup$
Actually, no. If it is a good Hash, you should roughly have $N-k$ bits of output entropy for some $k$ of much lower order than $N$.
The problem arises when the input is much longer than $N$ bits.
One way to estimate the entropy loss of such a Hash applied to $N$ bit inputs is to model it as a randomly chosen function on $N$ bits.
This was first done by Odlyzko and Flajolet. There is a nice review with updated results here
Let $tau_m$ be the image size of the $m$th iterate of the function. The entropy can be related to its behaviour.
If the function is a permutation, $tau_m=2^N$ for all $mgeq 1$ and there is no entropy loss.
Edit: See the comment and link by @fgrieu which is an estimate of what I called $tau_1.$ He is saying that
$$
tau_1approx 2^{128-0.8272cdots }
$$
for $N=128.$
answered Feb 10 at 20:50
kodlukodlu
8,85611329
edited Feb 10 at 22:30
answered Feb 10 at 20:50
kodlukodlu
8,85611329
answered Feb 10 at 20:50
kodlukodlu
8,85611329
answered Feb 10 at 20:50
kodlukodlu
8,85611329
8,85611329
3
$begingroup$
Is there any estimate for the $k$?
$endgroup$
– kelalaka
Feb 10 at 21:12
1
$begingroup$
Except for small $N$, the $k$ depends very little on $N$, and for $N=128$ is already very close to its asymptotic value $eta=displaystyle{1over e}sum_{j=1}^infty{j;log_2jover j!};;=0.8272dotstext{bit}$. See this.
$endgroup$
– fgrieu
Feb 10 at 22:14
add a comment |
3
$begingroup$
Is there any estimate for the $k$?
$endgroup$
– kelalaka
Feb 10 at 21:12
1
$begingroup$
Except for small $N$, the $k$ depends very little on $N$, and for $N=128$ is already very close to its asymptotic value $eta=displaystyle{1over e}sum_{j=1}^infty{j;log_2jover j!};;=0.8272dotstext{bit}$. See this.
$endgroup$
– fgrieu
Feb 10 at 22:14
3
3
$begingroup$
Is there any estimate for the $k$?
$endgroup$
– kelalaka
Feb 10 at 21:12
$begingroup$
Is there any estimate for the $k$?
$endgroup$
– kelalaka
Feb 10 at 21:12
1
1
$begingroup$
Except for small $N$, the $k$ depends very little on $N$, and for $N=128$ is already very close to its asymptotic value $eta=displaystyle{1over e}sum_{j=1}^infty{j;log_2jover j!};;=0.8272dotstext{bit}$. See this.
$endgroup$
– fgrieu
Feb 10 at 22:14
$begingroup$
Except for small $N$, the $k$ depends very little on $N$, and for $N=128$ is already very close to its asymptotic value $eta=displaystyle{1over e}sum_{j=1}^infty{j;log_2jover j!};;=0.8272dotstext{bit}$. See this.
$endgroup$
– fgrieu
Feb 10 at 22:14
add a comment |
Thanks for contributing an answer to Cryptography Stack Exchange!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
Use MathJax to format equations. MathJax reference.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fcrypto.stackexchange.com%2fquestions%2f67217%2fcan-we-estimate-the-loss-of-entropy-when-applying-a-n-bit-hash-function-to-and-n%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
4
$begingroup$
Possible duplicate of Entropy when iterating cryptographic hash functions. The only reason it might not be a duplicate is because this question asks about MD5 specifically.
$endgroup$
– Ella Rose♦
Feb 10 at 21:22
1
$begingroup$
Possible duplicate of If a SHA256 hash with high entropy is then hashed with one made from low entropy, is the resulting hash higher/same/lower entropy?
$endgroup$
– Squeamish Ossifrage
7 hours ago