Can we estimate the loss of entropy when applying a N-bit hash function to and N-bit random input?












3












$begingroup$


Someone pointed out recently to me that a cryptographic hash function " is not designed as a bijective mapping from N bit input to N bit output".



So if I feed an N-bit cryptographic hash function with N bits of random input, there's a loss of entropy between the input and output of the hash function.



Considering the md5 hash function, is there a way to estimate that loss of entropy? And is this loss cumulative so I could say, if I apply the hash function enough times, I end up with a 50% loss of entropy?






hash entropy







share|improve this question









New contributor




Sylvain Leroux is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.







$endgroup$








  • 3




    $begingroup$
    Possible duplicate of Entropy when iterating cryptographic hash functions. The only reason it might not be a duplicate is because this question asks about MD5 specifically.
    $endgroup$
    – Ella Rose♦
    4 hours ago
















3












$begingroup$


Someone pointed out recently to me that a cryptographic hash function " is not designed as a bijective mapping from N bit input to N bit output".



So if I feed an N-bit cryptographic hash function with N bits of random input, there's a loss of entropy between the input and output of the hash function.



Considering the md5 hash function, is there a way to estimate that loss of entropy? And is this loss cumulative so I could say, if I apply the hash function enough times, I end up with a 50% loss of entropy?






hash entropy







share|improve this question









New contributor




Sylvain Leroux is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.







$endgroup$








  • 3




    $begingroup$
    Possible duplicate of Entropy when iterating cryptographic hash functions. The only reason it might not be a duplicate is because this question asks about MD5 specifically.
    $endgroup$
    – Ella Rose♦
    4 hours ago














3












3








3





$begingroup$


Someone pointed out recently to me that a cryptographic hash function " is not designed as a bijective mapping from N bit input to N bit output".



So if I feed an N-bit cryptographic hash function with N bits of random input, there's a loss of entropy between the input and output of the hash function.



Considering the md5 hash function, is there a way to estimate that loss of entropy? And is this loss cumulative so I could say, if I apply the hash function enough times, I end up with a 50% loss of entropy?






hash entropy







share|improve this question









New contributor




Sylvain Leroux is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.







$endgroup$




Someone pointed out recently to me that a cryptographic hash function " is not designed as a bijective mapping from N bit input to N bit output".



So if I feed an N-bit cryptographic hash function with N bits of random input, there's a loss of entropy between the input and output of the hash function.



Considering the md5 hash function, is there a way to estimate that loss of entropy? And is this loss cumulative so I could say, if I apply the hash function enough times, I end up with a 50% loss of entropy?






hash entropy




hash entropy






share|improve this question









New contributor




Sylvain Leroux is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.











share|improve this question









New contributor




Sylvain Leroux is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.









share|improve this question




share|improve this question








edited 5 hours ago







Sylvain Leroux













New contributor




Sylvain Leroux is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.









asked 5 hours ago









Sylvain LerouxSylvain Leroux

1164




1164




New contributor




Sylvain Leroux is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.





New contributor





Sylvain Leroux is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.






Sylvain Leroux is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.








  • 3




    $begingroup$
    Possible duplicate of Entropy when iterating cryptographic hash functions. The only reason it might not be a duplicate is because this question asks about MD5 specifically.
    $endgroup$
    – Ella Rose♦
    4 hours ago














  • 3




    $begingroup$
    Possible duplicate of Entropy when iterating cryptographic hash functions. The only reason it might not be a duplicate is because this question asks about MD5 specifically.
    $endgroup$
    – Ella Rose♦
    4 hours ago








3




3




$begingroup$
Possible duplicate of Entropy when iterating cryptographic hash functions. The only reason it might not be a duplicate is because this question asks about MD5 specifically.
$endgroup$
– Ella Rose♦
4 hours ago




$begingroup$
Possible duplicate of Entropy when iterating cryptographic hash functions. The only reason it might not be a duplicate is because this question asks about MD5 specifically.
$endgroup$
– Ella Rose♦
4 hours ago










1 Answer
1






active

oldest

votes


















3












$begingroup$

Actually, no. If it is a good Hash, you should roughly have $N-k$ bits of output entropy for some $k$ of much lower order than $N$.



The problem arises when the input is much longer than $N$ bits.



One way to estimate the entropy loss of such a Hash applied to $N$ bit inputs is to model it as a randomly chosen function on $N$ bits.
This was first done by Odlyzko and Flajolet. There is a nice review with updated results here



Let $tau_m$ be the image size of the $m$th iterate of the function. The entropy can be related to its behaviour.



If the function is a permutation, $tau_m=2^N$ for all $mgeq 1$ and there is no entropy loss.



Edit: See the comment and link by @fgrieu which is an estimate of what I called $tau_1.$ He is saying that
$$
tau_1approx 2^{128-0.8272cdots }
$$
for $N=128.$






share|improve this answer











$endgroup$









  • 3




    $begingroup$
    Is there any estimate for the $k$?
    $endgroup$
    – kelalaka
    5 hours ago






  • 1




    $begingroup$
    Except for small $N$, the $k$ depends very little on $N$, and for $N=128$ is already very close to its asymptotic value $eta=displaystyle{1over e}sum_{j=1}^infty{j;log_2jover j!};;=0.8272dotstext{bit}$. See this.
    $endgroup$
    – fgrieu
    4 hours ago













Your Answer





StackExchange.ifUsing("editor", function () {
return StackExchange.using("mathjaxEditing", function () {
StackExchange.MarkdownEditor.creationCallbacks.add(function (editor, postfix) {
StackExchange.mathjaxEditing.prepareWmdForMathJax(editor, postfix, [["$", "$"], ["\\(","\\)"]]);
});
});
}, "mathjax-editing");

StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "281"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);

StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});

function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: false,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
noCode: true, onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});


}
});






Sylvain Leroux is a new contributor. Be nice, and check out our Code of Conduct.










draft saved

draft discarded


















StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fcrypto.stackexchange.com%2fquestions%2f67217%2fcan-we-estimate-the-loss-of-entropy-when-applying-a-n-bit-hash-function-to-and-n%23new-answer', 'question_page');
}
);

Post as a guest















Required, but never shown

























1 Answer
1






active

oldest

votes








1 Answer
1






active

oldest

votes









active

oldest

votes






active

oldest

votes









3












$begingroup$

Actually, no. If it is a good Hash, you should roughly have $N-k$ bits of output entropy for some $k$ of much lower order than $N$.



The problem arises when the input is much longer than $N$ bits.



One way to estimate the entropy loss of such a Hash applied to $N$ bit inputs is to model it as a randomly chosen function on $N$ bits.
This was first done by Odlyzko and Flajolet. There is a nice review with updated results here



Let $tau_m$ be the image size of the $m$th iterate of the function. The entropy can be related to its behaviour.



If the function is a permutation, $tau_m=2^N$ for all $mgeq 1$ and there is no entropy loss.



Edit: See the comment and link by @fgrieu which is an estimate of what I called $tau_1.$ He is saying that
$$
tau_1approx 2^{128-0.8272cdots }
$$
for $N=128.$






share|improve this answer











$endgroup$









  • 3




    $begingroup$
    Is there any estimate for the $k$?
    $endgroup$
    – kelalaka
    5 hours ago






  • 1




    $begingroup$
    Except for small $N$, the $k$ depends very little on $N$, and for $N=128$ is already very close to its asymptotic value $eta=displaystyle{1over e}sum_{j=1}^infty{j;log_2jover j!};;=0.8272dotstext{bit}$. See this.
    $endgroup$
    – fgrieu
    4 hours ago


















3












$begingroup$

Actually, no. If it is a good Hash, you should roughly have $N-k$ bits of output entropy for some $k$ of much lower order than $N$.



The problem arises when the input is much longer than $N$ bits.



One way to estimate the entropy loss of such a Hash applied to $N$ bit inputs is to model it as a randomly chosen function on $N$ bits.
This was first done by Odlyzko and Flajolet. There is a nice review with updated results here



Let $tau_m$ be the image size of the $m$th iterate of the function. The entropy can be related to its behaviour.



If the function is a permutation, $tau_m=2^N$ for all $mgeq 1$ and there is no entropy loss.



Edit: See the comment and link by @fgrieu which is an estimate of what I called $tau_1.$ He is saying that
$$
tau_1approx 2^{128-0.8272cdots }
$$
for $N=128.$






share|improve this answer











$endgroup$









  • 3




    $begingroup$
    Is there any estimate for the $k$?
    $endgroup$
    – kelalaka
    5 hours ago






  • 1




    $begingroup$
    Except for small $N$, the $k$ depends very little on $N$, and for $N=128$ is already very close to its asymptotic value $eta=displaystyle{1over e}sum_{j=1}^infty{j;log_2jover j!};;=0.8272dotstext{bit}$. See this.
    $endgroup$
    – fgrieu
    4 hours ago
















3












3








3





$begingroup$

Actually, no. If it is a good Hash, you should roughly have $N-k$ bits of output entropy for some $k$ of much lower order than $N$.



The problem arises when the input is much longer than $N$ bits.



One way to estimate the entropy loss of such a Hash applied to $N$ bit inputs is to model it as a randomly chosen function on $N$ bits.
This was first done by Odlyzko and Flajolet. There is a nice review with updated results here



Let $tau_m$ be the image size of the $m$th iterate of the function. The entropy can be related to its behaviour.



If the function is a permutation, $tau_m=2^N$ for all $mgeq 1$ and there is no entropy loss.



Edit: See the comment and link by @fgrieu which is an estimate of what I called $tau_1.$ He is saying that
$$
tau_1approx 2^{128-0.8272cdots }
$$
for $N=128.$






share|improve this answer











$endgroup$



Actually, no. If it is a good Hash, you should roughly have $N-k$ bits of output entropy for some $k$ of much lower order than $N$.



The problem arises when the input is much longer than $N$ bits.



One way to estimate the entropy loss of such a Hash applied to $N$ bit inputs is to model it as a randomly chosen function on $N$ bits.
This was first done by Odlyzko and Flajolet. There is a nice review with updated results here



Let $tau_m$ be the image size of the $m$th iterate of the function. The entropy can be related to its behaviour.



If the function is a permutation, $tau_m=2^N$ for all $mgeq 1$ and there is no entropy loss.



Edit: See the comment and link by @fgrieu which is an estimate of what I called $tau_1.$ He is saying that
$$
tau_1approx 2^{128-0.8272cdots }
$$
for $N=128.$







share|improve this answer














share|improve this answer



share|improve this answer








edited 3 hours ago

























answered 5 hours ago









kodlukodlu

8,72111229




8,72111229








  • 3




    $begingroup$
    Is there any estimate for the $k$?
    $endgroup$
    – kelalaka
    5 hours ago






  • 1




    $begingroup$
    Except for small $N$, the $k$ depends very little on $N$, and for $N=128$ is already very close to its asymptotic value $eta=displaystyle{1over e}sum_{j=1}^infty{j;log_2jover j!};;=0.8272dotstext{bit}$. See this.
    $endgroup$
    – fgrieu
    4 hours ago
















  • 3




    $begingroup$
    Is there any estimate for the $k$?
    $endgroup$
    – kelalaka
    5 hours ago






  • 1




    $begingroup$
    Except for small $N$, the $k$ depends very little on $N$, and for $N=128$ is already very close to its asymptotic value $eta=displaystyle{1over e}sum_{j=1}^infty{j;log_2jover j!};;=0.8272dotstext{bit}$. See this.
    $endgroup$
    – fgrieu
    4 hours ago










3




3




$begingroup$
Is there any estimate for the $k$?
$endgroup$
– kelalaka
5 hours ago




$begingroup$
Is there any estimate for the $k$?
$endgroup$
– kelalaka
5 hours ago




1




1




$begingroup$
Except for small $N$, the $k$ depends very little on $N$, and for $N=128$ is already very close to its asymptotic value $eta=displaystyle{1over e}sum_{j=1}^infty{j;log_2jover j!};;=0.8272dotstext{bit}$. See this.
$endgroup$
– fgrieu
4 hours ago






$begingroup$
Except for small $N$, the $k$ depends very little on $N$, and for $N=128$ is already very close to its asymptotic value $eta=displaystyle{1over e}sum_{j=1}^infty{j;log_2jover j!};;=0.8272dotstext{bit}$. See this.
$endgroup$
– fgrieu
4 hours ago












Sylvain Leroux is a new contributor. Be nice, and check out our Code of Conduct.










draft saved

draft discarded


















Sylvain Leroux is a new contributor. Be nice, and check out our Code of Conduct.













Sylvain Leroux is a new contributor. Be nice, and check out our Code of Conduct.












Sylvain Leroux is a new contributor. Be nice, and check out our Code of Conduct.
















Thanks for contributing an answer to Cryptography Stack Exchange!


  • Please be sure to answer the question. Provide details and share your research!

But avoid …



  • Asking for help, clarification, or responding to other answers.

  • Making statements based on opinion; back them up with references or personal experience.


Use MathJax to format equations. MathJax reference.


To learn more, see our tips on writing great answers.




draft saved


draft discarded














StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fcrypto.stackexchange.com%2fquestions%2f67217%2fcan-we-estimate-the-loss-of-entropy-when-applying-a-n-bit-hash-function-to-and-n%23new-answer', 'question_page');
}
);

Post as a guest















Required, but never shown





















































Required, but never shown














Required, but never shown












Required, but never shown







Required, but never shown

































Required, but never shown














Required, but never shown












Required, but never shown







Required, but never shown







-

Popular posts from this blog

How to label and detect the document text images

Image
1 $begingroup$ This is what I mean as document text image: I want to label the texts in image as separate blocks and my model should detect these labels as classes. NOTE: This is how the end result should be like: The labels like Block 1, Block 2, Block 3,.. should be Logo, Title, Date,.. Others, etc. Work done: First approach : I tried to implement this method via Object Detection, it didn't work. It didn't even detect any text. Second approach : Then I tried it using PixelLink. As this model is build for scene text detection, it detected each and every text in the image. But this method can detect multiple lines of text if the threshold values are increased. But I have no idea how do I add labels to the text blocks. PIXEL_CLS_WEIGHT_all_ones = 'PIXEL_CLS_WEIGHT_all_ones' PIXEL_C...
Read more

Vallis Paradisi

Image
Coordinata: .mw-parser-output .geo-default,.mw-parser-output .geo-dms,.mw-parser-output .geo-dec{display:inline}.mw-parser-output .geo-nondefault,.mw-parser-output .geo-multi-punct{display:none}.mw-parser-output .longitude,.mw-parser-output .latitude{white-space:nowrap} 33°03′S 71°37′W  /  33.05°S 71.617°W  / -33.05; -71.617 Vallis Paradisi Res apud Vicidata repertae: Civitas : Chilia Numerus incolarum : 296 655 Zona horaria : UTC-4 Situs interretialis Nomen officiale : Valparaíso Gubernium Consilium : municipal council of Valparaíso Geographia Superficies : 401 600 000 Metrum quadratum Coniunctiones urbium Urbes gemellae : Ovetum , Badalona , Santa Fe , Ora longa , Sciamhaevum , Quantunia , Callao , Bat Yam , Melaka , Novorossiysk , Busan , Corduba , Odessa , Rosario , Malacca , Barcino , Soteropolis , Franciscopolis (California) , Guanajuato, Silao Tabula aut despectus Despectus in portum sinumque et urbem Vallis Paradisi Vallis Para...
Read more

Tabula Rosettana

Image
Tabula multilinguis Rosettana in Museo Britannico ostenditur. Tabula Rosettana, [1] etiam titulo OGIS 90 agnita, est stela decreto de rebus sacris in Aegypto anno 196 a.C.n. lato inscripta. Tabula iuxta Rosettam Aegypti, urbem in delta Nili et ad oram maris Mediterranei iacentem, anno 1799 a milite Francico reperta est. Inventio stelae, linguis duabus scripturisque tribus inscriptae, eruditis Instituti Aegypti statim nuntiata est; ibi enim iussu imperatoris Napoleonis eruditi omnium scientiarum (sub aegide Commissionis Scientiarum et Artium) properaverant cum expeditione Francica. Qua a Britannis mox debellata, tabula Rosettana Londinium missa hodie apud Museum Britannicum iacet. Textus Graecus cito lectus interpretationi textuum Aegyptiorum (in formis hieroglyphica et demotica expressorum) gradatim adiuvit. Denique textum plene interpretatus est Ioannes Franciscus Champollion. Ab opere eruditorum cumulativo coepit hodiernus scripturae hieroglyphicae linguaeque Aegyptiae a...
Read more