Hashing SSNs and other limited-domain information

Question

I\'m currently working on an application where we receive private health information. One of the biggest concerns is with the SSN. Currently, we don\'t use the SSN for any

Answer 1

If you seriously want to hash a social security number in a secure way, do this:

1. Find out how much entropy is in an SSN (hint: there is very little. Far less than a randomly chosen 9 digit number).
2. Use any hashing algorithm.
3. Keep fewer (half?) bits than there is entropy in an SSN.

Result:

• Pro: Secure hash of an SSN because of a large number of hash collisions.
• Pro: Your hashes are short and easy to store.
• Con: Hash collisions.
• Con: You can't use it for a unique identifier because of Con#1.
• Pro: That's good because you really really need to not be using SSNs as identifiers unless you are the Social Security Administration.