2

Modern hash functions are considered to be efficient to calculate by boolean circuits (i.e their implementation are using bits- operations).

I'm looking for a cryptographic hash function, that can be efficient calculate by arithmetic circuits (i.e they use OR and AND gates (or $+$ and $\cdot$ gates) and work over $\operatorname{GF}(q)$.

After bit of search, I found MASH-1 and MASH-2 constructions, but they seem to include the $\text{xor}$ function that I'm trying to eliminate.

Maarten Bodewes
  • 92,551
  • 13
  • 161
  • 313
user1387682
  • 455
  • 2
  • 9

1 Answers1

3

You could try Ajtai's hash function:

What is Ajtai's hash function?

Given a matrix $A \hookleftarrow U(\mathbb{Z}_q^{n \times m})$ and a column vector $\vec{m} \in \mathbb{Z}_d^m$, the hash of the message $\vec{m}$ is given by

$H(\vec{m}) = A\vec{m} \mod q$

If you're not comfortable with linear algebra (and perhaps lattices too) it might be more challenging to implement than something like SHA256.

As for the efficiency, that depends on your definition of "efficient". I doubt it will compete with something like SHA256/SHA512/BLAKE2 for speed; But to be fair, few algorithms will beat BLAKE2.

Note

You will need to take extra care to ensure that the implementation functions in constant time. With bitwise operations, this is significantly easier to accomplish, which is one motivation to use them.

Community
  • 1
Ella Rose
  • 19,603
  • 6
  • 53
  • 101
  • Thanks! My only problem is that $\vec{m} \in Z_{q}^{m}$ and the input isn't from $\mathbb{F}_q$, can I overcome this problem somehow? – user1387682 Aug 22 '18 at 23:16
  • @user1387682 I'm not sure I understand the question. The definition for the message to be hashed is a column vector in $\mathbb Z^{m}_d$ rather than $\mathbb F_q$. Or do you mean that you need a hash where the input is from $\mathbb F_q$ rather than $\mathbb Z^{m}_d$? – Ella Rose Aug 26 '18 at 15:47