Do hash functions need to "look random"? I've noticed that looking random is not often listed as a requirement for a good hash function in the same way that preimage or collision resistance is.


Do we need hash functions to look random?


Specifically, suppose $s$ is a seed, and consider the PRNG that outputs $$H(s \|0)  \| H(s \|1 ) \| H(s \|2) \| ...$$


Do we need this to be indistinguishable from random?
Will any protocols be weakened if it wasn't?
The answer is most certainly not! Well, I sort of lied, since it depends on what you are doing. I'll explain.

The basic property of hash functions is collision resistance, and this requires nothing beyond that. The output doesn't have to look random in any form, and this suffices for anywhere that you need collision resistance.

However, in many cases, because most hash functions in practice do look sort of random (completely undefined), they are used for other things. For example, HMAC assumes that the compression function (with one part of the input being the key) is essentially a pseudorandom function. More extreme, but very common examples, are the modeling of the hash function as a "random oracle". This is used for OEAP encryption padding, in most cases in practice for signatures, and more. You also somewhat assume this property for hashing passwords. (Note that for any hash function $H$, if you define $H'(x) = x|_n\|H(x)$ where $x|_n$ is the first $n$ bits of $x$, then $H'$ is collision resistant if $H$ is collision resistant. However $H'$ would be a very poor choice for password hashing.)