2

I´m trying to anonymize an message-thread id to prevent re-identification even with full access to the source database.

  1. I need consistency when processing, so that multiple instances of say "100" produces the same hash just like a regular hashing algorithm.
  2. I need to cut the cord at one point and delete the key/seed, so that it´s impossible to produce the hash using "100" in the future.

Thank you for any pointers. Example in Python or Java would be appreciated.

Update - Practical application of the answer:

I generated a 24 character password on https://www.random.org/ to use as a seed/key.

I found a simple implementation on this Gist: https://gist.github.com/ishikawa/88599

So the plan is to delete the key from my code once I´m ready and the data will be fully detached from it´s origin.

  • 1
    Which hash algorithm have you tried so far that didn't work for you? – Limit Sep 24 '16 at 22:15
  • SHA-1, maybe i'm missing something. Maybe i should key encryption and delete the key. – tovare Sep 24 '16 at 22:43
6

What it sounds like you need is a keyed hash. Perhaps the most common example is HMAC. It takes your data and key, in order to produce the output which will be deterministic, so you will get the same MAC output for 100 (your sample input) every time. When you're finished computing the hashes on your data, delete the key, and you will no longer be able to compute the same MACs without brute forcing the key. Assuming the key you've chosen is strong enough (say, 128-bits from a CSPRNG) and this will not be feasible even with all of the computing power on earth for all time.

  • Good answer, but note that just like an (symmetric) encryption key, the key must be kept private. This means that others won't be able to verify that the message matches the hash, even before you delete the key. If that's OK (or desirable), great. If not, it'll get harder. – CBHacking Sep 24 '16 at 23:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.