Hash to prime numbers?

Question

Is there some provably secure hash function to prime numbers?
Say, a function $H: \{0, 1\}^* \rightarrow \{e: e \in \{0, 1\}^\lambda \land e$ is prime$\}$

I'm asking because there are some constructions to be used only on prime numbers (for example CL02 Strong-RSA Dynamic Accumulators).

Answer 1

You could use the hash value as seed for a deterministic CSPRNG and then use a prime number generator also used for RSA key pair generation. Note that the size of the prime number must be relatively high (1536 bits for 128 bits of security, e.g. for an RSA key of 3072 bits).

The usual caveats of deterministic RSA key pair generation apply. For instance, the algorithms must remain the same, otherwise a different prime value is calculated for the same hash value.

Generally the method of generating the prime value is available separately in math or crypto libraries that come with the runtime. For instance, Java has the BigInteger(int bitLength, int certainty, Random rnd) constructor.

Beware that the time it takes to find a prime is unknown in advance. The generation may take a long time (and in the case of Java may also take a ridiculous number of bytes from the DRBG - just tested this).

Answer 2

I think what makes this difficult is the definition of "secure." Clearly $H(m)=2$ always outputs a prime number, but it is not considered secure.

For it to be "secure," one would expect every prime number to have an equal probability of being chosen, given a random input. Since you can enumerate the prime numbers below a certain value, the problem is isomorphic to a "normal" hash which generates an integer from 0..$\pi(2^\lambda)$ where $\pi$ is a function which counts the number of primes up to a certain value. If you can demonstrate that your normal hash generates unpredictable results with a uniform distribution, then your proof is complete.

However, finding a function for the first $\pi(2^\lambda)$ primes is tricky, especially if $\lambda$ is large.

Potentially of interest is a paper by Jones, Sato, Wada, and Weins from 1976. In it, they produced a fascinating polynomial of degree 25 in 26 variables which yields a prime number, 1, or a negative number for all non-negative integers. Interestingly, it also generates every prime number, so it is guaranteed to contain all $\pi(2^\lambda)$ primes you want.

Of course, that is a 26 variable function, and it makes no guarantees about repeating prime numbers in a non-uniform distribution. But you could in theory find a loop through these numbers which generates every prime number you want. If you could do some massaging to get it into the form of a cyclic group, you could rapidly index through it and generate such numbers efficiently.

However, I do believe that, even if creating such a cyclic group is possible, it would likely require an amount of initial effort proportional to $\pi(2^\lambda)$ at the least. The result might be nice and compact, but generating it would be abysmal.

Generating prime numbers by an equation is fascinatingly difficult. While there is, in theory, a polynomial time solution to your problem, it's not clear how to efficiently determine what that is.

Answer 3

Another (naive) solution:

Take you favourite (cryptographic) hash function $H$. For an element $x \in \{0,1\}^*$, define $H'(x)$ as the first prime number in the $H$-orbit of $x$. That is,

\begin{align*} & n_x := \min \{n:\ H^{(n)}(x) \text{ is prime} \} ; \\ & H' (x) := H^{(n_x)}(x), \end{align*} where $H^{(n)}(x)$ is the $n$-fold iteration $(H\circ ... \circ H)(x)$. The function $H'$ is collision and pre-image resistant assuming $H$ is, and it attains prime values. However, it is not very efficiently computable.

Runtime analysis (in the random oracle model): by the Prime number theorem, the expectation of $n_x$ (regardless of x) is the number of bits. That is, if you are using SHA-256, then in expectation it would take you 256 guesses to find a prime number. To check primality, you can use the probabilistic Miller-Rabin that runs in $\log^2(x)$, or the deterministic AKS algorithm that (conjecturely) runs in $\log^6(x)$.

Answer 4

Relatively prime polynomials are as good as prime numbers sometimes*. In such a case, $(1 + ex) \in Z[X]$ are prime for just different $e$ produced with the hash function (collision resistance).

[*] Set equality testing is an obvious example: just compare two products of polynomials accumulating set elements. Efficient polynomial equality test is crucial, resulting in a nice proof of having a solution to specific sudoku puzzle. Polynomial graph representation and isomorphism testing is another example.

Answer 5

This answer updated since new foundings

Let $H$ be a (provably) secure hash function $H:\{0,1\}^* \rightarrow \{2^h\}$, where $h$ is the output size of the $H$.

Now, using this $H$, we will construct a (provably) secure hash function to primes $H'$ as follows;

• let $P$ be Oracle of Mathematica Prime[n] function.
• given message $m$ output;

$$H'(m) := \text{Prime}[H(m)]$$

Since this is just a bijection, $H'$ is a (provably) secure hash function.

Note: I looked for the theory of this Prime[n] function but couldn't. The Mathematica find the $n-th$ prime very quickly. Try $\text{Prime}[2^{512}]$ at WolframAlpha.