CFP last date
20 November 2026
Call for Paper
December Edition
IJCA solicits high quality original research papers for the upcoming December edition of the journal. The last date of research paper submission is 20 November 2026

Submit your paper
Know more
The week's pick
Responsive image
A Machine Learning-based Decision Framework for Demand Forecasting and Price Optimization in Competitive E-Commerce Environments

Aera K. Leboulluec Janhavi Datye
Random Articles
Reseach Article

Choosing Cryptographic Hash Functions: A Security-, Performance-, and Application-Aware Survey

by Ashishkumar Gor, Ami M. Shah, Ankit P. Vaishnav
journal cover thumbnail

International Journal of Computer Applications
Foundation of Computer Science (FCS), NY, USA
Volume 187 - Number 149
Year of Publication: 2026
Authors: Ashishkumar Gor, Ami M. Shah, Ankit P. Vaishnav
10.5120/ijca1a979a992aa1

Ashishkumar Gor, Ami M. Shah, Ankit P. Vaishnav . Choosing Cryptographic Hash Functions: A Security-, Performance-, and Application-Aware Survey. International Journal of Computer Applications. 187, 149 ( Oct 2026), 1-17. DOI=10.5120/ijca1a979a992aa1

@article{ 10.5120/ijca1a979a992aa1,
author = { Ashishkumar Gor, Ami M. Shah, Ankit P. Vaishnav },
title = { Choosing Cryptographic Hash Functions: A Security-, Performance-, and Application-Aware Survey },
journal = { International Journal of Computer Applications },
issue_date = { Oct 2026 },
volume = { 187 },
number = { 149 },
month = { Oct },
year = { 2026 },
issn = { 0975-8887 },
pages = { 1-17 },
numpages = {9},
url = { https://ijcaonline.org/archives/volume187/number149/choosing-cryptographic-hash-functions-a-security-performance-and-application-aware-survey/ },
doi = { 10.5120/ijca1a979a992aa1 },
publisher = {Foundation of Computer Science (FCS), NY, USA},
address = {New York, USA}
}
%0 Journal Article
%1 2026-10-24T03:08:53.851681+05:30
%A Ashishkumar Gor
%A Ami M. Shah
%A Ankit P. Vaishnav
%T Choosing Cryptographic Hash Functions: A Security-, Performance-, and Application-Aware Survey
%J International Journal of Computer Applications
%@ 0975-8887
%V 187
%N 149
%P 1-17
%D 2026
%I Foundation of Computer Science (FCS), NY, USA
Abstract

Cryptographic hash functions are routinely selected by name—for example, “use SHA-256”—even though the suitability of a hash function depends on a richer set of requirements: collision, preimage, and second-preimage resistance; construction-level attack surface; digest and state sizes; domain separation; keyed or extendable-output functionality; short-message latency; bulk throughput; memory and energy constraints; implementation ecosystem; and standardization status. This survey develops an application-aware view of hash-function choice rather than a chronological catalogue of algorithms. It organizes modern hashing around iterative Merkle–Damg˚ard designs, permutation/sponge designs, tree/parallel designs, and lightweight standardized designs; connects generic security bounds to multicollision, long-message second-preimage, herding, practical collision, and chosen-prefix collision results; and maps those properties to digital signatures, message authentication, software integrity, Merkle structures, content-addressed storage, embedded/IoT systems, password processing, and post-quantum hash-based signatures. The survey further introduces a Security–Performance–Application (SPA) selection model that first filters candidates using non-negotiable security constraints and then ranks feasible candidates using application-weighted performance and deployment criteria. To complement the analytical discussion, three controlled experiments examine throughput versus message size for SHA-2, SHA-3, and BLAKE2 implementations exposed through Python’s hashlib (with OpenSSL used where applicable), single-bit avalanche behavior, and birthday collisions on deliberately truncated SHA-256 outputs. In the measured runtime environment, SHA-256 attained the highest bulk throughput among the tested standardized fixed-output functions, while BLAKE2s led the 64-byte test; all tested functions showed mean avalanche behavior close to 50%; and the observed first-collision counts for 16–24-bit truncations closely followed the birthday expectation. A cross-size normalized analysis further demonstrates that the relative ranking changes materially with message size. These measurements are illustrative of implementation/platform effects and are not universal rankings. The survey closes with a decision procedure and open research directions for transparent, context-sensitive hash-function selection.

References
  1. Elaine Barker and Allen Roginsky. Transitioning the use of cryptographic algorithms and key lengths. NIST Special Publication 800-131A Rev. 2, National Institute of Standards and Technology, 2019.
  2. Alex Biryukov, Daniel Dinu, Dmitry Khovratovich, and Simon Josefsson. Argon2 memory-hard function for password hashing and proof-of-work applications. RFC 9106, 2021.
  3. Gilles Brassard, Peter Høyer, and Alain Tapp. Quantum cryptanalysis of hash and claw-free functions. ACM SIGACT News, 28(2):14–19, 1997.
  4. Ivan Bjerre Damg˚ard. A design principle for hash functions. In Advances in Cryptology—CRYPTO ’89 Proceedings, volume 435 of Lecture Notes in Computer Science, pages 416–427. Springer, 1990. Proceedings of CRYPTO ’89; conference held in 1989.
  5. Quynh H. Dang. Recommendation for applications using approved hash algorithms. NIST Special Publication 800-107 Rev. 1, National Institute of Standards and Technology, 2012. NIST announced a planned withdrawal after migration of remaining requirements to other guidance.
  6. Lov K. Grover. A fast quantum mechanical algorithm for database search. In Proceedings of the Twenty-Eighth Annual ACM Symposium on Theory of Computing, pages 212–219. ACM, 1996.
  7. Antoine Joux. Multicollisions in iterated hash functions. application to cascaded constructions. In Advances in Cryptology—CRYPTO 2004, volume 3152 of Lecture Notes in Computer Science, pages 306–316. Springer, 2004.
  8. John Kelsey, Shu-jen Chang, and Ray Perlner. SHA-3 derived functions: cshake, kmac, tuplehash, and parallelhash. NIST Special Publication 800-185, National Institute of Standards and Technology, 2016.
  9. John Kelsey and Tadayoshi Kohno. Herding hash functions and the nostradamus attack. In Advances in Cryptology— EUROCRYPT 2006, volume 4004 of Lecture Notes in Computer Science, pages 183–200. Springer, 2006.
  10. John Kelsey and Bruce Schneier. Second preimages on n-bit hash functions for much less than 2n work. In Advances in Cryptology—EUROCRYPT 2005, volume 3494 of Lecture Notes in Computer Science, pages 474–490. Springer, 2005.
  11. Hugo Krawczyk, Mihir Bellare, and Ran Canetti. HMAC: Keyed-hashing for message authentication. RFC 2104, 1997.
  12. Ga¨etan Leurent and Thomas Peyrin. SHA-1 is a shambles: First chosen-prefix collision on SHA-1 and application to the PGP web of trust. In 29th USENIX Security Symposium (USENIX Security 20), pages 1839–1856. USENIX Association, 2020.
  13. Ralph C. Merkle. A certified digital signature. In Advances in Cryptology—CRYPTO ’89 Proceedings, volume 435 of Lecture Notes in Computer Science, pages 218–238. Springer, 1990. Proceedings of CRYPTO ’89; conference held in 1989.
  14. Satoshi Nakamoto. Bitcoin: A peer-to-peer electronic cash system. White paper, October 2008. Accessed 2 September 2026.
  15. National Institute of Standards and Technology. Secure hash standard (shs). Federal Information Processing Standards Publication FIPS 180-4, National Institute of Standards and Technology, 2015.
  16. National Institute of Standards and Technology. SHA-3 standard: Permutation-based hash and extendable-output functions. Federal Information Processing Standards Publication FIPS 202, National Institute of Standards and Technology, 2015.
  17. National Institute of Standards and Technology. Stateless hash-based digital signature standard. Federal Information Processing Standards Publication FIPS 205, National Institute of Standards and Technology, 2024.
  18. Jack O’Connor, Jean-Philippe Aumasson, Samuel Neves, and Zooko Wilcox-O’Hearn. BLAKE3: One function, fast everywhere. Algorithm specification, 2020. Version 20200109113900; project specification at blake3.io.
  19. Markku-Juhani Saarinen and Jean-Philippe Aumasson. The BLAKE2 cryptographic hash and message authentication code (MAC). RFC 7693, 2015.
  20. Marc Stevens, Elie Bursztein, Pierre Karpman, Ange Albertini, and Yarik Markov. The first collision for full SHA-1. In Advances in Cryptology—CRYPTO 2017, Part I, volume 10401 of Lecture Notes in Computer Science, pages 570–596. Springer, 2017.
  21. Meltem S¨onmez Turan, Kerry McKay, Jinkeon Kang, John Kelsey, and Donghoon Chang. Ascon-based lightweight cryptography standards for constrained devices: Authenticated encryption, hash, and extendable output functions. NIST Special Publication 800-232, National Institute of Standards and Technology, August 2025.
  22. XiaoyunWang and Hongbo Yu. How to break MD5 and other hash functions. In Advances in Cryptology—EUROCRYPT 2005, volume 3494 of Lecture Notes in Computer Science, pages 19–35. Springer, 2005.
Index Terms

Computer Science
Information Sciences

Keywords

Cryptographic hash function collision resistance preimage resistance SHA-2 SHA-3 BLAKE2 Ascon blockchain IoT benchmarking application-aware selection

Powered by PhDFocusTM