hash-domain-separation · shipping · also Domain-separated hashing

Hash domain separation

Hash domain separation encodes an input's role or context so distinct uses of a hash function do not share the same input representation.

Related Observatory article: Hash domain separation on hesela.com

RFC 9162 distinguishes Merkle leaves and internal nodes with different initial bytes. This prevents a leaf from reusing the exact input encoding of a parent node. [1]

Hesela's two-entry example demonstrates the untagged ambiguity without finding a SHA-256 collision. It also checks the independently trusted entry count; this is an educational construction, not a CT or storage-product exploit. [2]

Relations

related

merkle-tree, cryptographic-hash, hash-collision

Limitations

• Role separation does not authenticate the root or establish freshness; serialization and the rest of the verification protocol still matter. [1]

Citations

1. RFC 9162: Certificate Transparency Version 2.0, sections 2.1.1 and 4.10 (accessed 2026-10-18)
2. Hesela: Two trees, one root, no broken hash (accessed 2026-10-18)

JSON: /data/terms/hash-domain-separation.json