The Hash Function and the Hash Value

In one line

A hash function turns any amount of data into a short number that acts as its fingerprint, and it is what makes a digital signature possible.

In the wording a student can write in an exam: a hash function is an algorithm that maps a sequence of bits of any length into another, generally smaller, fixed-length set known as the hash result, such that the same input always yields the same result, that it is computationally infeasible to reconstruct the original from the result, and that it is computationally infeasible for two different inputs to produce the same result; the Explanation to section 3(2) of the Information Technology Act, 2000 adopts precisely that definition.

Why the Act defines it

Because section 3(2) uses it, and the whole mechanism of the digital signature depends on it. Section 3(2) provides that the authentication of the electronic record shall be effected by the use of an asymmetric crypto system and hash function which envelop and transform the initial electronic record into another electronic record.

And because the Act's draftsman knew that the reader would not know what a hash function is, so the Explanation defines it. That is unusual and useful: the statute itself contains a plain statement of the mathematics.

The Act's own definition

"For the purposes of this sub-section, 'hash function' means an algorithm mapping or translation of one sequence of bits into another, generally smaller, set known as 'hash result' such that an electronic record yields the same hash result every time the algorithm is executed with the same electronic record as its input making it computationally infeasible (a) to derive or reconstruct the original electronic record from the hash result produced by the algorithm; (b) that two electronic records can produce the same hash result using the algorithm."

Three properties are stated there and they are the three that matter.

Determinism. "An electronic record yields the same hash result every time the algorithm is executed with the same electronic record as its input." Same input, same output, always, on any machine, in any year.

Pre-image resistance, which the section calls being computationally infeasible to derive or reconstruct the original. The function runs one way. Knowing the hash tells you nothing about the document.

Collision resistance, which the section states as its being computationally infeasible that two electronic records can produce the same hash result. No two different documents share a hash, as a practical matter.

Note the word the Act uses: infeasible, not impossible. With infinite time both could be done. The security is that the time required exceeds anything anyone has.

What a hash actually looks like

Fixed length, whatever goes in. The function in general use, SHA-256, produces 256 bits, written as sixty-four hexadecimal characters, for any input at all. A one-line email and a two-hour film both produce sixty-four characters.