Fowler–Noll–Vo hash function
Fowler–Noll–Vo is a non-cryptographic hash function created by Glenn Fowler, Landon Curt Noll, and Kiem-Phong Vo.
The basis of the FNV hash algorithm was taken from an idea sent as reviewer comments to the IEEE POSIX P1003.2 committee by Glenn Fowler and Phong Vo in 1991. In a subsequent ballot round, Landon Curt Noll improved on their algorithm. In an email message to Landon, they named it the Fowler/Noll/Vo or FNV hash.
Overview
The current versions are FNV-1 and FNV-1a, which supply a means of creating non-zero FNV offset basis. FNV currently comes in 32-, 64-, 128-, 256-, 512-, and 1024-bit flavors. For pure FNV implementations, this is determined solely by the availability of FNV primes for the desired bit length; however, the FNV webpage discusses methods of adapting one of the above versions to a smaller length that may or may not be a power of two.The FNV hash algorithms and reference FNV source code have been released into the public domain.
For many years, the Python programming language used a slightly modified version of the FNV hash for its default
hash function. This was changed in Python 3.4 in order to protect from DoS attacks to Python applications.FNV is not a cryptographic hash.
The hash
One of FNV's key advantages is that it is very simple to implement. Start with an initial hash value of FNV offset basis. For each byte in the input, multiply hash by the FNV prime, then XOR it with the byte from the input. The alternate algorithm, FNV-1a, reverses the multiply and XOR steps.FNV-1 hash
The FNV-1 hash algorithm is as follows:algorithm fnv-1 is
hash := FNV_offset_basis do
for each byte_of_data to be hashed
hash := hash × FNV_prime
hash := hash XOR byte_of_data
return hash
In the above pseudocode, all variables are unsigned integers. All variables, except for byte_of_data, have the same number of bits as the FNV hash. The variable, byte_of_data, is an 8 bit unsigned integer.
As an example, consider the 64-bit FNV-1 hash:
- All variables, except for byte_of_data, are 64-bit unsigned integers.
- The variable, byte_of_data, is an 8-bit unsigned integer.
- The FNV_offset_basis is the 64-bit FNV offset basis value: 14695981039346656037.
- The FNV_prime is the 64-bit FNV prime value: 1099511628211.
- The multiply returns the lower 64-bits of the product.
- The XOR is an 8-bit operation that modifies only the lower 8-bits of the hash value.
- The hash value returned is a 64-bit unsigned integer.
FNV-1a hash
algorithm fnv-1a is
hash := FNV_offset_basis
for each byte_of_data to be hashed do
hash := hash XOR byte_of_data
hash := hash × FNV_prime
return hash
The above pseudocode has the same assumptions that were noted for the FNV-1 pseudocode. The change in order leads to slightly better avalanche characteristics.
FNV-0 hash (deprecated)
The FNV-0 hash differs from the FNV-1 hash only by the initialisation value of the hash variable:algorithm fnv-0 is
hash := 0
for each byte_of_data to be hashed do
hash := hash × FNV_prime
hash := hash XOR byte_of_data
return hash
The above pseudocode has the same assumptions that were noted for the FNV-1 pseudocode.
Use of the FNV-0 hash is deprecated except for the computing of the FNV offset basis for use as the FNV-1 and FNV-1a hash parameters.
FNV offset basis
There are several different FNV offset basis for various bit lengths. These FNV offset basis are computed by computing the FNV-0 from the following 32 octets when expressed in ASCII:which is one of Landon Curt Noll's signature lines. This is the only current practical use for the deprecated FNV-0.
FNV prime
An FNV prime is a prime number and is determined as follows:For a given :
where is:
and where is:
then the n-bit FNV prime is the smallest prime number that is of the form:
such that:
Experimentally, FNV prime matching the above constraints tend to have better dispersion properties. They improve the polynomial feedback characteristic when an FNV prime multiplies an intermediate hash value. As such, the hash values produced are more scattered throughout the n-bit hash space.
FNV hash parameters
The above FNV prime constraints and the definition of the FNV offset basis yield the following table of FNV hash parameters:| Size in bits | Representation | FNV prime | FNV offset basis |
| 32 | Expression | 224 + 28 + 0x93 | |
| 32 | Decimal | 16777619 | 2166136261 |
| 32 | Hexadecimal | 0x01000193 | 0x811c9dc5 |
| 64 | Expression | 240 + 28 + 0xb3 | |
| 64 | Decimal | 1099511628211 | 14695981039346656037 |
| 64 | Hexadecimal | 0x00000100000001B3 | 0xcbf29ce484222325 |
| 128 | Representation | 288 + 28 + 0x3b | |
| 128 | Decimal | 309485009821345068724781371 | 144066263297769815596495629667062367629 |
| 128 | Hexadecimal | 0x0000000001000000000000000000013B | 0x6c62272e07bb014262b821756295c58d |
| 256 | Representation | 2168 + 28 + 0x63 | |
| 256 | Decimal | 374144419156711147060143317 175368453031918731002211 | 100029257958052580907070968620625704837 092796014241193945225284501741471925557 |
| 256 | Hexadecimal | 0x00000000000000000000010000000000 00000000000000000000000000000163 | 0xdd268dbcaac550362d98c384c4e576ccc8b153 6847b6bbb31023b4c8caee0535 |
| 512 | Representation | 2344 + 28 + 0x57 | |
| 512 | Decimal | 358359158748448673689190764 890951084499463279557543925 583998256154206699388825751 26094039892345713852759 | 965930312949666949800943540071631046609 041874567263789610837432943446265799458 293219771643844981305189220653980578449 5328239340083876191928701583869517785 |
| 512 | Hexadecimal | 0x0000000000000000 0000000000000000 0000000001000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000157 | 0xb86db0b1171f4416 dca1e50f309990ac ac87d059c9000000 0000000000000d21 e948f68a34c192f6 2ea79bc942dbe7ce 182036415f56e34b ac982aac4afe9fd9 |
| 1024 | Representation | 2680 + 28 + 0x8d | |
| 1024 | Decimal | 501645651011311865543459881103 527895503076534540479074430301 752383111205510814745150915769 222029538271616265187852689524 938529229181652437508374669137 180409427187316048473796672026 0389217684476157468082573 | 14197795064947621068722070641403218320 88062279544193396087847491461758272325 22967323037177221508640965212023555493 65628174669108571814760471015076148029 75596980407732015769245856300321530495 71501574036444603635505054127112859663 61610267868082893823963790439336411086 884584107735010676915 |
| 1024 | Hexadecimal | 0x0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000010000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 000000000000018D | 0x0000000000000000 005f7a76758ecc4d 32e56d5a591028b7 4b29fc4223fdada1 6c3bf34eda3674da 9a21d90000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 000000000004c6d7 eb6e73802734510a 555f256cc005ae55 6bde8cc9c6a93b21 aff4b16c71ee90b3 |
Non-cryptographic hash
The FNV hash was designed for fast hash table and checksum use, not cryptography. The authors have identified the following properties as making the algorithm unsuitable as a cryptographic hash function:- Speed of Computation – As a hash designed primarily for hashtable and checksum use, FNV-1 and FNV-1a were designed to be fast to compute. However, this same speed makes finding specific hash values by brute force faster.
- Sticky State – Being an iterative hash based primarily on multiplication and XOR, the algorithm is sensitive to the number zero. Specifically, if the hash value were to become zero at any point during calculation, and the next byte hashed were also all zeroes, the hash would not change. This makes colliding messages trivial to create given a message that results in a hash value of zero at some point in its calculation. Additional operations, such as the addition of a third constant prime on each step, can mitigate this but may have detrimental effects on avalanche effect or random distribution of hash values.
- Diffusion – The ideal secure hash function is one in which each byte of input has an equally-complex effect on every bit of the hash. In the FNV hash, the ones place is always the XOR of the rightmost bit of every input byte. This can be mitigated by XOR-folding.