Keyspace enumeration

Keyspace enumeration is reversing a hash by trying every possible input, which is feasible whenever the input space is small. Phone numbers (about ten billion) and IPv4 addresses (about four billion) are trivially enumerable on commodity hardware, so an unkeyed hash of either is a pseudonym, not an irreversible transform. The defense is a keyed hash whose secret the attacker does not hold.

The number to check is the size of the input space, not the strength of the hash. SHA-256 is not broken by this; it is simply fast, and ten billion candidates at commodity speeds is minutes of work. A stronger hash slows enumeration without changing the conclusion, which is why the answer is a key rather than a better digest.

The same reasoning covers email addresses drawn from a known list and any identifier with a published format.

The arithmetic is what makes the argument, and it is worth doing out loud rather than gesturing at. Around ten billion candidate phone numbers, hashed at commodity speeds, is minutes of work on hardware anyone can rent, and the result is a complete lookup table from digest back to number. No property of the hash function changes that conclusion.

Formats with published structure shrink the space further. Numbers in a known country, in an allocated range, belonging to a known operator, are a small fraction of the nominal ten billion, and an attacker who knows the population being targeted starts from that subset rather than from the full range.

This is why pseudonymization claims over enumerable identifiers do not hold on their own: if re-attribution is feasible with reasonably available means, the data is still personal data. The remedy is a key the attacker does not hold, which is keyed hashing, and the control is where that key lives rather than which digest algorithm was chosen.