The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →SequenceHash is a way to hash an ordered sequence of byte strings without losing track of where one value ends and the next begins. It encodes each input separately before combining the results, rather than simply hashing the values’ concatenated bytes. Its keyed companion, SequenceMAC, applies the same general idea to message authentication. Both are constructions whose security depends on the underlying hash function.
Why does hashing multiple values need special handling?
Suppose an application has two variable-length values and hashes them by joining their bytes first. The pairs ("ab", "c") and ("a", "bc") both become abc. A hash of that concatenation cannot distinguish the original pairings. That is a framing ambiguity: the bytes alone do not say where one input ended and another began.
As an Amazon Associate I earn from qualifying purchases.
SequenceHash is designed for hashing a sequence of byte strings while retaining those boundaries. The Trail of Bits announcement describes a 128-bit byte-count suffix for each input. The length information distinguishes values with different boundaries even when their concatenated bytes are identical. The sequence is also ordered: changing the order of values changes the input being hashed.
Recommended Free Tools
This is useful when a protocol needs one digest to commit to several distinct fields, messages, or objects. It does not decide which fields belong in that sequence or how an application converts them to bytes; those remain protocol-design choices.
How does SequenceHash work?
Each value is framed separately
Instead of treating successive values as one undifferentiated byte stream, SequenceHash encodes each value with its byte length. The Trail of Bits description specifies a fixed-width 128-bit length suffix. Because the length is part of each encoded input, different partitions of the same concatenated bytes are not treated as the same sequence.
Length suffixes and streaming
The announcement presents the suffix format as streaming-friendly, including when an input’s full length is not known before processing begins. The stated encoded-length ceiling is 2128−1 bytes per input. That is a limit of the length encoding, not a promise that every underlying hash can accept an input that large: SHA-256 and SHA-512 have lower input-size limits.
Double hashing and customization
The construction is described as using a double-hash design to protect against length-extension attacks. Optional customization data is applied in the outer layer, so the announcement says the inner hash can be reused when only that customization changes. Customization can distinguish outputs intended for different contexts, but it does not replace including the actual protocol inputs that need to be bound.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Trail of Bits describes SequenceHash as hash-agnostic and structurally related to HMAC, naming SHA-256, SHA-384, SHA-512, BLAKE, and RIPEMD as examples. Hash-agnostic means the construction can be paired with different hash functions; it does not mean all choices are equally secure. A framing scheme cannot make a weak or obsolete hash such as MD4 or SHA-0, or a non-cryptographic hash, suitable for security-sensitive use.
What is SequenceMAC?
SequenceMAC is SequenceHash’s keyed companion: it is intended to authenticate a sequence of separately framed inputs using a secret key. The Trail of Bits announcement says its design adds key metadata and addresses key-pseudocollision concerns associated with long HMAC keys. It describes supported key lengths from 32 bytes up to 2128−1 bytes; these are stated design limits, not a performance recommendation or an independently measured result.
As with SequenceHash, the choice of underlying hash matters to security. SequenceMAC is not a substitute for a secure key-management process, and the construction’s framing does not authenticate fields that an application leaves out of the sequence.
How does SequenceHash compare with NIST TupleHash?
TupleHash is a genuine alternative for hashing multiple values with unambiguous boundaries. Trail of Bits describes TupleHash as a good choice when it is available; SequenceHash’s distinguishing appeal is its stated flexibility to use hash functions other than Keccak. The announcement’s comparison is about design and use, not the result of a head-to-head benchmark or independent comparative security review.
Free tools Windows power users keep installed
One-click scans. No signup required.
| Axis | SequenceHash | TupleHash |
|---|---|---|
| Underlying construction | Described by Trail of Bits as hash-agnostic, with SHA-2, BLAKE, and RIPEMD examples. | Described by Trail of Bits as defined around Keccak. |
| Input boundaries | Uses a fixed-width 128-bit byte-count suffix for each input, according to the announcement. | Uses length-prefix encoding, according to the announcement. |
| Streaming and output | The suffix encoding is presented as allowing streaming when input lengths are not known in advance. | The announcement describes support for inputs of effectively unlimited size and operation as an XOF. |
| When it may fit | Consider it when a protocol needs a non-Keccak underlying hash or its stated API and design features. | Consider it when a suitable implementation is available; Trail of Bits calls it a good tool for that case. |
The practical decision is therefore not that one construction is universally safer or better. Check which design fits the protocol’s hash requirements and which implementations are available and appropriate for the target environment.
What should developers know about the implementations?
In its 2026-10-02 announcement, Trail of Bits said initial implementations were available in Rust, Go, and Python, alongside test vectors containing intermediate values. That establishes the languages announced at that time; it does not establish current release versions, support in other languages, production adoption, or an audit status.
- Updates represent values, not arbitrary stream chunks. The announced APIs make each update or add operation atomic: each call contributes an independently encoded value. This differs from conventional streaming hash APIs, where multiple writes are generally equivalent to hashing their concatenation. Porting code between these API styles without preserving value boundaries can change what is being hashed.
- Use vectors to debug framing. Intermediate values in the announced test vectors can help locate a mismatch between implementations. The C2SP specification is the normative place to check the construction and vectors.
- Check current release details before integrating. The announcement gives an initial implementation state, not package names, version numbers, or a guarantee of present-day maintenance. Consult the current specification and the relevant implementation’s release notes before relying on language support or copying API instructions.
What application-level choices remain your responsibility?
Unambiguous cryptographic framing solves only the boundary problem for the byte strings actually supplied. It cannot make different application serializations equivalent or complete a protocol design on its own.
- Choose a canonical representation. Participants must agree on field order, text encoding, and serialization rules. The same logical JSON or XML data can be serialized into different bytes; SequenceHash hashes bytes, not abstract documents.
- Include all relevant inputs. A digest or MAC commits only to the values provided. In Fiat–Shamir uses, for example, the surrounding proof context—including relevant group parameters and generators—still needs to be bound as the protocol requires.
- Choose output length for the application. The construction does not decide an adequate digest size. Where an output is converted to a value modulo some number, the application may also need to account for modulo bias.
- Select a suitable underlying hash. SequenceHash and SequenceMAC inherit the security limitations of that hash; the name of the construction does not upgrade a weak primitive.
Where might these constructions be useful?
The Trail of Bits announcement gives hashing files in an archive, grouping cryptocurrency transactions, hashing names, and making commitments to secret values with a blinding value as possible uses. C2SP also lists avoiding replay of earlier messages in multi-round protocols and binding Fiat–Shamir transcripts to a proof type. These are examples of potential applications, not evidence that SequenceHash has been deployed in those systems.
What is established—and what is not?
The C2SP specification and Trail of Bits announcement describe the construction, its intended properties, and the initial implementations. The materials cited here do not establish an independent audit, formal proof review, comparative benchmark, production deployment, or adoption statistic. That absence of evidence should not be read as proof that none exists; it means those claims cannot be inferred from the announcement and specification alone.
Best Value
- Grokking Algorithms: An illustrated guide
- For programmers and other curious people
- It is made up of premium quality material.
The announcement also says a SequenceXOF may be considered later; it does not establish XOF support for SequenceHash. TupleHash’s XOF behavior in the comparison table should not be taken as a feature of SequenceHash.
Is SequenceHash the same as multihash or SeqHasher?
No. “Multihash” can refer to a separate Multiformats protocol that tags hash outputs with a function code and digest size. SeqHasher is a separate utility for hashing biological sequences in FASTA and FASTQ files. Neither name refers to this SequenceHash construction for hashing sequences of byte strings.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
