Can we estimate the loss of entropy when applying a N-bit hash function to and N-bit random input?
$begingroup$
Someone pointed out recently to me that a cryptographic hash function " is not designed as a bijective mapping from N bit input to N bit output".
So if I feed an N-bit cryptographic hash function with N bits of random input, there's a loss of entropy between the input and output of the hash function.
Considering the md5 hash function, is there a way to estimate that loss of entropy? And is this loss cumulative so I could say, if I apply the hash function enough times, I end up with a 50% loss of entropy?
hash entropy
asked 10 hours ago
Sylvain LerouxSylvain Leroux
1164
New contributor
Sylvain Leroux is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
$endgroup$
add a comment |
$begingroup$
Someone pointed out recently to me that a cryptographic hash function " is not designed as a bijective mapping from N bit input to N bit output".
So if I feed an N-bit cryptographic hash function with N bits of random input, there's a loss of entropy between the input and output of the hash function.
Considering the md5 hash function, is there a way to estimate that loss of entropy? And is this loss cumulative so I could say, if I apply the hash function enough times, I end up with a 50% loss of entropy?
hash entropy
asked 10 hours ago
Sylvain LerouxSylvain Leroux
1164
New contributor
Sylvain Leroux is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
$endgroup$
3
$begingroup$
Possible duplicate of Entropy when iterating cryptographic hash functions. The only reason it might not be a duplicate is because this question asks about MD5 specifically.
$endgroup$
– Ella Rose♦
9 hours ago
add a comment |
$begingroup$
Someone pointed out recently to me that a cryptographic hash function " is not designed as a bijective mapping from N bit input to N bit output".
So if I feed an N-bit cryptographic hash function with N bits of random input, there's a loss of entropy between the input and output of the hash function.
Considering the md5 hash function, is there a way to estimate that loss of entropy? And is this loss cumulative so I could say, if I apply the hash function enough times, I end up with a 50% loss of entropy?
hash entropy
asked 10 hours ago
Sylvain LerouxSylvain Leroux
1164
New contributor
Sylvain Leroux is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
$endgroup$
Someone pointed out recently to me that a cryptographic hash function " is not designed as a bijective mapping from N bit input to N bit output".
So if I feed an N-bit cryptographic hash function with N bits of random input, there's a loss of entropy between the input and output of the hash function.
Considering the md5 hash function, is there a way to estimate that loss of entropy? And is this loss cumulative so I could say, if I apply the hash function enough times, I end up with a 50% loss of entropy?
hash entropy
hash entropy
asked 10 hours ago
Sylvain LerouxSylvain Leroux
1164
New contributor
Sylvain Leroux is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
asked 10 hours ago
Sylvain LerouxSylvain Leroux
1164
New contributor
Sylvain Leroux is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
edited 10 hours ago
Sylvain Leroux
asked 10 hours ago
Sylvain LerouxSylvain Leroux
1164
New contributor
Sylvain Leroux is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
asked 10 hours ago
Sylvain LerouxSylvain Leroux
1164
asked 10 hours ago
Sylvain LerouxSylvain Leroux
1164
1164
New contributor
Sylvain Leroux is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
New contributor
Sylvain Leroux is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
Sylvain Leroux is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
3
$begingroup$
Possible duplicate of Entropy when iterating cryptographic hash functions. The only reason it might not be a duplicate is because this question asks about MD5 specifically.
$endgroup$
– Ella Rose♦
9 hours ago
add a comment |
3
$begingroup$
Possible duplicate of Entropy when iterating cryptographic hash functions. The only reason it might not be a duplicate is because this question asks about MD5 specifically.
$endgroup$
– Ella Rose♦
9 hours ago
3
3
$begingroup$
Possible duplicate of Entropy when iterating cryptographic hash functions. The only reason it might not be a duplicate is because this question asks about MD5 specifically.
$endgroup$
– Ella Rose♦
9 hours ago
$begingroup$
Possible duplicate of Entropy when iterating cryptographic hash functions. The only reason it might not be a duplicate is because this question asks about MD5 specifically.
$endgroup$
– Ella Rose♦
9 hours ago
add a comment |
1 Answer
1
active
oldest
votes
$begingroup$
Actually, no. If it is a good Hash, you should roughly have $N-k$ bits of output entropy for some $k$ of much lower order than $N$.
The problem arises when the input is much longer than $N$ bits.
One way to estimate the entropy loss of such a Hash applied to $N$ bit inputs is to model it as a randomly chosen function on $N$ bits.
This was first done by Odlyzko and Flajolet. There is a nice review with updated results here
Let $tau_m$ be the image size of the $m$th iterate of the function. The entropy can be related to its behaviour.
If the function is a permutation, $tau_m=2^N$ for all $mgeq 1$ and there is no entropy loss.
Edit: See the comment and link by @fgrieu which is an estimate of what I called $tau_1.$ He is saying that
$$
tau_1approx 2^{128-0.8272cdots }
$$
for $N=128.$
answered 10 hours ago
kodlukodlu
8,72111229
$endgroup$
3
$begingroup$
Is there any estimate for the $k$?
$endgroup$
– kelalaka
9 hours ago
1
$begingroup$
Except for small $N$, the $k$ depends very little on $N$, and for $N=128$ is already very close to its asymptotic value $eta=displaystyle{1over e}sum_{j=1}^infty{j;log_2jover j!};;=0.8272dotstext{bit}$. See this.
$endgroup$
– fgrieu
8 hours ago
add a comment |
Your Answer
StackExchange.ifUsing("editor", function () {
return StackExchange.using("mathjaxEditing", function () {
StackExchange.MarkdownEditor.creationCallbacks.add(function (editor, postfix) {
StackExchange.mathjaxEditing.prepareWmdForMathJax(editor, postfix, [["$", "$"], ["\\(","\\)"]]);
});
});
}, "mathjax-editing");
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "281"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: false,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
noCode: true, onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sylvain Leroux is a new contributor. Be nice, and check out our Code of Conduct.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fcrypto.stackexchange.com%2fquestions%2f67217%2fcan-we-estimate-the-loss-of-entropy-when-applying-a-n-bit-hash-function-to-and-n%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
$begingroup$
Actually, no. If it is a good Hash, you should roughly have $N-k$ bits of output entropy for some $k$ of much lower order than $N$.
The problem arises when the input is much longer than $N$ bits.
One way to estimate the entropy loss of such a Hash applied to $N$ bit inputs is to model it as a randomly chosen function on $N$ bits.
This was first done by Odlyzko and Flajolet. There is a nice review with updated results here
Let $tau_m$ be the image size of the $m$th iterate of the function. The entropy can be related to its behaviour.
If the function is a permutation, $tau_m=2^N$ for all $mgeq 1$ and there is no entropy loss.
Edit: See the comment and link by @fgrieu which is an estimate of what I called $tau_1.$ He is saying that
$$
tau_1approx 2^{128-0.8272cdots }
$$
for $N=128.$
answered 10 hours ago
kodlukodlu
8,72111229
$endgroup$
3
$begingroup$
Is there any estimate for the $k$?
$endgroup$
– kelalaka
9 hours ago
1
$begingroup$
Except for small $N$, the $k$ depends very little on $N$, and for $N=128$ is already very close to its asymptotic value $eta=displaystyle{1over e}sum_{j=1}^infty{j;log_2jover j!};;=0.8272dotstext{bit}$. See this.
$endgroup$
– fgrieu
8 hours ago
add a comment |
$begingroup$
Actually, no. If it is a good Hash, you should roughly have $N-k$ bits of output entropy for some $k$ of much lower order than $N$.
The problem arises when the input is much longer than $N$ bits.
One way to estimate the entropy loss of such a Hash applied to $N$ bit inputs is to model it as a randomly chosen function on $N$ bits.
This was first done by Odlyzko and Flajolet. There is a nice review with updated results here
Let $tau_m$ be the image size of the $m$th iterate of the function. The entropy can be related to its behaviour.
If the function is a permutation, $tau_m=2^N$ for all $mgeq 1$ and there is no entropy loss.
Edit: See the comment and link by @fgrieu which is an estimate of what I called $tau_1.$ He is saying that
$$
tau_1approx 2^{128-0.8272cdots }
$$
for $N=128.$
answered 10 hours ago
kodlukodlu
8,72111229
$endgroup$
3
$begingroup$
Is there any estimate for the $k$?
$endgroup$
– kelalaka
9 hours ago
1
$begingroup$
Except for small $N$, the $k$ depends very little on $N$, and for $N=128$ is already very close to its asymptotic value $eta=displaystyle{1over e}sum_{j=1}^infty{j;log_2jover j!};;=0.8272dotstext{bit}$. See this.
$endgroup$
– fgrieu
8 hours ago
add a comment |
$begingroup$
Actually, no. If it is a good Hash, you should roughly have $N-k$ bits of output entropy for some $k$ of much lower order than $N$.
The problem arises when the input is much longer than $N$ bits.
One way to estimate the entropy loss of such a Hash applied to $N$ bit inputs is to model it as a randomly chosen function on $N$ bits.
This was first done by Odlyzko and Flajolet. There is a nice review with updated results here
Let $tau_m$ be the image size of the $m$th iterate of the function. The entropy can be related to its behaviour.
If the function is a permutation, $tau_m=2^N$ for all $mgeq 1$ and there is no entropy loss.
Edit: See the comment and link by @fgrieu which is an estimate of what I called $tau_1.$ He is saying that
$$
tau_1approx 2^{128-0.8272cdots }
$$
for $N=128.$
answered 10 hours ago
kodlukodlu
8,72111229
$endgroup$
Actually, no. If it is a good Hash, you should roughly have $N-k$ bits of output entropy for some $k$ of much lower order than $N$.
The problem arises when the input is much longer than $N$ bits.
One way to estimate the entropy loss of such a Hash applied to $N$ bit inputs is to model it as a randomly chosen function on $N$ bits.
This was first done by Odlyzko and Flajolet. There is a nice review with updated results here
Let $tau_m$ be the image size of the $m$th iterate of the function. The entropy can be related to its behaviour.
If the function is a permutation, $tau_m=2^N$ for all $mgeq 1$ and there is no entropy loss.
Edit: See the comment and link by @fgrieu which is an estimate of what I called $tau_1.$ He is saying that
$$
tau_1approx 2^{128-0.8272cdots }
$$
for $N=128.$
answered 10 hours ago
kodlukodlu
8,72111229
edited 8 hours ago
answered 10 hours ago
kodlukodlu
8,72111229
answered 10 hours ago
kodlukodlu
8,72111229
answered 10 hours ago
kodlukodlu
8,72111229
8,72111229
3
$begingroup$
Is there any estimate for the $k$?
$endgroup$
– kelalaka
9 hours ago
1
$begingroup$
Except for small $N$, the $k$ depends very little on $N$, and for $N=128$ is already very close to its asymptotic value $eta=displaystyle{1over e}sum_{j=1}^infty{j;log_2jover j!};;=0.8272dotstext{bit}$. See this.
$endgroup$
– fgrieu
8 hours ago
add a comment |
3
$begingroup$
Is there any estimate for the $k$?
$endgroup$
– kelalaka
9 hours ago
1
$begingroup$
Except for small $N$, the $k$ depends very little on $N$, and for $N=128$ is already very close to its asymptotic value $eta=displaystyle{1over e}sum_{j=1}^infty{j;log_2jover j!};;=0.8272dotstext{bit}$. See this.
$endgroup$
– fgrieu
8 hours ago
3
3
$begingroup$
Is there any estimate for the $k$?
$endgroup$
– kelalaka
9 hours ago
$begingroup$
Is there any estimate for the $k$?
$endgroup$
– kelalaka
9 hours ago
1
1
$begingroup$
Except for small $N$, the $k$ depends very little on $N$, and for $N=128$ is already very close to its asymptotic value $eta=displaystyle{1over e}sum_{j=1}^infty{j;log_2jover j!};;=0.8272dotstext{bit}$. See this.
$endgroup$
– fgrieu
8 hours ago
$begingroup$
Except for small $N$, the $k$ depends very little on $N$, and for $N=128$ is already very close to its asymptotic value $eta=displaystyle{1over e}sum_{j=1}^infty{j;log_2jover j!};;=0.8272dotstext{bit}$. See this.
$endgroup$
– fgrieu
8 hours ago
add a comment |
Sylvain Leroux is a new contributor. Be nice, and check out our Code of Conduct.
Sylvain Leroux is a new contributor. Be nice, and check out our Code of Conduct.
Sylvain Leroux is a new contributor. Be nice, and check out our Code of Conduct.
Sylvain Leroux is a new contributor. Be nice, and check out our Code of Conduct.
Thanks for contributing an answer to Cryptography Stack Exchange!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
Use MathJax to format equations. MathJax reference.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fcrypto.stackexchange.com%2fquestions%2f67217%2fcan-we-estimate-the-loss-of-entropy-when-applying-a-n-bit-hash-function-to-and-n%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
3
$begingroup$
Possible duplicate of Entropy when iterating cryptographic hash functions. The only reason it might not be a duplicate is because this question asks about MD5 specifically.
$endgroup$
– Ella Rose♦
9 hours ago