{
  "slug": "hash-domain-separation",
  "term": "Hash domain separation",
  "aliases": [
    "Domain-separated hashing"
  ],
  "definition": "Hash domain separation encodes an input's role or context so distinct uses of a hash function do not share the same input representation.",
  "note": "RFC 9162 distinguishes Merkle leaves and internal nodes with different initial bytes. This prevents a leaf from reusing the exact input encoding of a parent node. [rfc9162]\n\nHesela's two-entry example demonstrates the untagged ambiguity without finding a SHA-256 collision. It also checks the independently trusted entry count; this is an educational construction, not a CT or storage-product exploit. [hesela-example]",
  "status": "shipping",
  "advantages": [],
  "limitations": [
    {
      "text": "Role separation does not authenticate the root or establish freshness; serialization and the rest of the verification protocol still matter.",
      "citationIds": [
        "rfc9162"
      ]
    }
  ],
  "related": [
    "merkle-tree",
    "cryptographic-hash",
    "hash-collision"
  ],
  "supersedes": [],
  "supersededBy": [],
  "firstSeen": null,
  "lastSeen": null,
  "citations": [
    {
      "id": "rfc9162",
      "title": "RFC 9162: Certificate Transparency Version 2.0, sections 2.1.1 and 4.10",
      "url": "https://www.rfc-editor.org/rfc/rfc9162.html",
      "accessed": "2026-10-18"
    },
    {
      "id": "hesela-example",
      "title": "Hesela: Two trees, one root, no broken hash",
      "url": "https://hesela.com/analyses/checksums-identity-and-lost-writes/#merkle-domain-separation",
      "accessed": "2026-10-18"
    }
  ],
  "updated": "2026-10-18"
}