Following are the desired properties of a strong hash function:

  1. Pre-image resistant: given , it is difficult to find the pre-image of the hash .
  2. Second pre-image resistance: given message , it is difficult to find another message such that .
  3. Collision resistance: It is difficult to find two distinct messages and such that .

collision resistance implies second pre-image resistance.1

According to literature, a hash function with output size has pre-image resistance, and second pre-image resistance and collision resistance due to birthday attack.

Putting commonly occurring 512 and 256 bits output size in the above statement: 2

  • 512 bits output gives bits of pre-image resistance and bits of collision resistance
  • 256 bits output gives bits of pre, and 128 bits of col.

Merkle-Damgård Constructions

Used in MD5, SHA1, SHA2.


Sponge constructions

Used in SHA3 (Keccak).

HAIFA construction

Used in Blake2.

Birthday attack


ZK Friendly hash functions

It’s natural to put cryptographic hash functions on protocols that boasts ZK properties like SNARKs or STARKs.



  1. Second pre-image resistance vs Collision resistance

  2. 512 bits vs 256 bits