Abstract

Cryptographic hash functions are routinely selected by name—for example, “use SHA-256”—even though the suitability of a hash function depends on a richer set of requirements: collision, preimage, and second-preimage resistance; construction-level attack surface; digest and state sizes; domain separation; keyed or extendable-output functionality; short-message latency; bulk throughput; memory and energy constraints; implementation ecosystem; and standardization status. This survey develops an application-aware view of hash-function choice rather than a chronological catalogue of algorithms. It organizes modern hashing around iterative Merkle–Damg˚ard designs, permutation/sponge designs, tree/parallel designs, and lightweight standardized designs; connects generic security bounds to multicollision, long-message second-preimage, herding, practical collision, and chosen-prefix collision results; and maps those properties to digital signatures, message authentication, software integrity, Merkle structures, content-addressed storage, embedded/IoT systems, password processing, and post-quantum hash-based signatures. The survey further introduces a Security–Performance–Application (SPA) selection model that first filters candidates using non-negotiable security constraints and then ranks feasible candidates using application-weighted performance and deployment criteria. To complement the analytical discussion, three controlled experiments examine throughput versus message size for SHA-2, SHA-3, and BLAKE2 implementations exposed through Python’s hashlib (with OpenSSL used where applicable), single-bit avalanche behavior, and birthday collisions on deliberately truncated SHA-256 outputs. In the measured runtime environment, SHA-256 attained the highest bulk throughput among the tested standardized fixed-output functions, while BLAKE2s led the 64-byte test; all tested functions showed mean avalanche behavior close to 50%; and the observed first-collision counts for 16–24-bit truncations closely followed the birthday expectation. A cross-size normalized analysis further demonstrates that the relative ranking changes materially with message size. These measurements are illustrative of implementation/platform effects and are not universal rankings. The survey closes with a decision procedure and open research directions for transparent, context-sensitive hash-function selection.

References

• Elaine Barker and Allen Roginsky. Transitioning the use of cryptographic algorithms and key lengths. NIST Special Publication 800-131A Rev. 2, National Institute of Standards and Technology, 2019.
• Alex Biryukov, Daniel Dinu, Dmitry Khovratovich, and Simon Josefsson. Argon2 memory-hard function for password hashing and proof-of-work applications. RFC 9106, 2021.
• Gilles Brassard, Peter Høyer, and Alain Tapp. Quantum cryptanalysis of hash and claw-free functions. ACM SIGACT News, 28(2):14–19, 1997.
• Ivan Bjerre Damg˚ard. A design principle for hash functions. In Advances in Cryptology—CRYPTO ’89 Proceedings, volume 435 of Lecture Notes in Computer Science, pages 416–427. Springer, 1990. Proceedings of CRYPTO ’89; conference held in 1989.
• Quynh H. Dang. Recommendation for applications using approved hash algorithms. NIST Special Publication 800-107 Rev. 1, National Institute of Standards and Technology, 2012. NIST announced a planned withdrawal after migration of remaining requirements to other guidance.
• Lov K. Grover. A fast quantum mechanical algorithm for database search. In Proceedings of the Twenty-Eighth Annual ACM Symposium on Theory of Computing, pages 212–219. ACM, 1996.
• Antoine Joux. Multicollisions in iterated hash functions. application to cascaded constructions. In Advances in Cryptology—CRYPTO 2004, volume 3152 of Lecture Notes in Computer Science, pages 306–316. Springer, 2004.
• John Kelsey, Shu-jen Chang, and Ray Perlner. SHA-3 derived functions: cshake, kmac, tuplehash, and parallelhash. NIST Special Publication 800-185, National Institute of Standards and Technology, 2016.
• John Kelsey and Tadayoshi Kohno. Herding hash functions and the nostradamus attack. In Advances in Cryptology— EUROCRYPT 2006, volume 4004 of Lecture Notes in Computer Science, pages 183–200. Springer, 2006.
• John Kelsey and Bruce Schneier. Second preimages on n-bit hash functions for much less than 2n work. In Advances in Cryptology—EUROCRYPT 2005, volume 3494 of Lecture Notes in Computer Science, pages 474–490. Springer, 2005.
• Hugo Krawczyk, Mihir Bellare, and Ran Canetti. HMAC: Keyed-hashing for message authentication. RFC 2104, 1997.
• Ga¨etan Leurent and Thomas Peyrin. SHA-1 is a shambles: First chosen-prefix collision on SHA-1 and application to the PGP web of trust. In 29th USENIX Security Symposium (USENIX Security 20), pages 1839–1856. USENIX Association, 2020.
• Ralph C. Merkle. A certified digital signature. In Advances in Cryptology—CRYPTO ’89 Proceedings, volume 435 of Lecture Notes in Computer Science, pages 218–238. Springer, 1990. Proceedings of CRYPTO ’89; conference held in 1989.
• Satoshi Nakamoto. Bitcoin: A peer-to-peer electronic cash system. White paper, October 2008. Accessed 2 September 2026.
• National Institute of Standards and Technology. Secure hash standard (shs). Federal Information Processing Standards Publication FIPS 180-4, National Institute of Standards and Technology, 2015.
• National Institute of Standards and Technology. SHA-3 standard: Permutation-based hash and extendable-output functions. Federal Information Processing Standards Publication FIPS 202, National Institute of Standards and Technology, 2015.
• National Institute of Standards and Technology. Stateless hash-based digital signature standard. Federal Information Processing Standards Publication FIPS 205, National Institute of Standards and Technology, 2024.
• Jack O’Connor, Jean-Philippe Aumasson, Samuel Neves, and Zooko Wilcox-O’Hearn. BLAKE3: One function, fast everywhere. Algorithm specification, 2020. Version 20200109113900; project specification at blake3.io.
• Markku-Juhani Saarinen and Jean-Philippe Aumasson. The BLAKE2 cryptographic hash and message authentication code (MAC). RFC 7693, 2015.
• Marc Stevens, Elie Bursztein, Pierre Karpman, Ange Albertini, and Yarik Markov. The first collision for full SHA-1. In Advances in Cryptology—CRYPTO 2017, Part I, volume 10401 of Lecture Notes in Computer Science, pages 570–596. Springer, 2017.
• Meltem S¨onmez Turan, Kerry McKay, Jinkeon Kang, John Kelsey, and Donghoon Chang. Ascon-based lightweight cryptography standards for constrained devices: Authenticated encryption, hash, and extendable output functions. NIST Special Publication 800-232, National Institute of Standards and Technology, August 2025.
• XiaoyunWang and Hongbo Yu. How to break MD5 and other hash functions. In Advances in Cryptology—EUROCRYPT 2005, volume 3494 of Lecture Notes in Computer Science, pages 19–35. Springer, 2005.