Hash functions are ubiquitous in information security: they are used for integrity checks, content-addressed storage, digital signatures, password verification, and more. This document treats three families of constructions that have received the most attention in practice and in the literature: MD5 (an historical design of the MD family), SHA-2 (notably SHA-256, standardized in FIPS 180), and SHA-3 (the Keccak-based family standardized in FIPS 202). Where necessary we contrast the design principles (MerkleDamgrd vs. sponge) and explain the consequences for security. Key primary sources are cited: the MD5 specification (RFC 1321), the SHA standards (FIPS 180-4), the SHA-3 standard (FIPS 202), and major cryptanalytic work on MD5 and related constructions. citeturn0search0turn0search7turn3search2
Let (H:{0,1}^* o{0,1}^n) be a deterministic function mapping binary strings of arbitrary length to fixed-length (n)-bit o