Rabin–Karp Rolling Hashing

• Rabin–Karp rolling hashing is a technique that uses a polynomial hash function updated in constant time as a sliding window moves through the string.
• It carefully selects parameters like base and modulus to optimize collision resistance, injectivity, and performance for tasks such as document fingerprinting and cryptographic applications.
• Its efficiency (average O(n+m) time) and reversible design facilitate high-throughput analytics and integration in zero-knowledge, privacy-preserving proofs.

The Rabin–Karp rolling hash is a fundamental primitive for efficient string-matching, $n$-gram indexing, document fingerprinting, and privacy-preserving protocols. Its hallmark is a polynomial hash function that can be updated in constant time as a fixed-length sliding window moves through a string, enabling rapid substring detection and comparison. The method supports both classical implementations for high-throughput analytics and advanced cryptographic applications such as zk-SNARK–based privacy-preserving string matching. The polynomial-based structure also allows for reversible (injective) algorithmic constructions and has direct impact on collision properties and statistical independence.

1. Mathematical Definition and Rolling Update Rule

Let $S$ be a string of length $m$ over an alphabet that is injectively mapped to integers, and fix a base $b$ (often denoted $d$ in some literature) and a prime modulus $q$ (or $p$). The Rabin–Karp polynomial hash of $S$ is

$H(S) = \sum_{j=0}^{m-1} S[j]\,b^{m-1-j}\;\bmod q$

or, equivalently,

$$H(S) = (S[0]\,b^{m-1} + S[1]\,b^{m-2} + \cdots + S[m-1])\bmod q$$

For a window of length $S$0 at position $S$1 in a longer string $S$2, the hash $S$3 is computed over $S$4.

The rolling update rule exploits the overlap between consecutive windows:

$S$5

where:

• The outgoing high-order symbol $S$6 weighted by $S$7 is subtracted and removed,
• The resulting hash is multiplied by $S$8 to shift digit positions,
• The incoming symbol $S$9 is added at the lower-order position,
• The final sum is reduced modulo $m$0 to keep the values bounded.

Precomputation of $m$1 allows for the subtraction step to be computed as $m$2, improving efficiency (Glück et al., 2022, Li et al., 20 May 2025, 0705.4676).

2. Parameterization, Collision Behavior, and Injectivity

Parameter choice is central to the method's collision resistance, update efficiency, and reversibility:

• Base $m$3: Typically a small prime slightly larger than the alphabet (e.g., $m$4 for ASCII). Larger bases distribute hash values more widely but incur identical modular multiplication costs.
• Modulus $m$5: Preference is given to a large prime (e.g., $m$6 or matching the native field of cryptosystems). Collision probability behaves as $m$7, so $m$8 on the order of $m$9 or $b$0 renders collisions negligible for texts of length up to $b$1.
• Coprimality: $b$2 and $b$3 are required to satisfy $b$4, ensuring that modular multiplication is invertible and the rolling hash update is injective—a necessity for reversible computation (Glück et al., 2022).

For reversible implementations, the update

$b$5

is injective under

• $b$6,
• $b$7 and $b$8,
• $b$9.

Every modular arithmetic operation ($d$0, $d$1, $d$2) is injective in its primary argument under these conditions. Reversibility is achieved without extra space or information loss via in-place, bijective updates (Glück et al., 2022).

3. Algorithmic Implementation and Complexity

A standard Rabin–Karp matcher operates in two phases:

1. Initialization: Hashes for the pattern and the first text window are computed in $d$3. For hash update, the only precomputed value is $d$4.
2. Sliding: For each shift $d$5, the rolling hash update is performed in $d$6 time, with explicit computation as above. Matches on hash equality are validated through a $d$7 character-wise check to eliminate false positives due to hash collisions. The overall time complexity is $d$8 in expectation. In the worst (collision-saturated) case, complexity degrades to $d$9 (Li et al., 20 May 2025, 0705.4676).

Pseudocode for rolling hash update (with precomputed $q$0): $$H(S) = (S[0]\,b^{m-1} + S[1]\,b^{m-2} + \cdots + S[m-1])\bmod q$$6 Memory overhead is $q$1, excluding storage of input strings (Li et al., 20 May 2025).

4. Statistical Independence and Limitations

No recursive (rolling) hash scheme, including the Rabin–Karp family, can achieve more than pairwise independence. Specifically, even randomized Karp–Rabin hashes fail to be pairwise independent for $q$2: distinct $q$3-grams may collide at rates above the uniform baseline. Only specialized polynomial schemes, notably over $q$4 with irreducible $q$5 and via independent random symbol mappings, are provably pairwise independent, with cost $q$6 per update for $q$7-bit hashes (0705.4676).

Key results:

• No 3-wise independence: For any recursive hash family, triple overlapping windows cannot be made fully independent due to the deterministic link introduced by the rolling recurrence.
• Uniformity only: Randomized Karp–Rabin schemes can be tuned to produce uniform output, but pairwise (let alone $q$8-wise) independence is unattainable except via computation from scratch with $q$9 cost (0705.4676).

Polynomial-based approaches over $p$0:

• General (irreducible) polynomials yield pairwise independence without bit discarding but require either $p$1 shifts or $p$2 memory for buffered operations.
• Cyclic polynomials ($p$3): Doubly fast, but require the discard of $p$4 hash bits to recover pairwise independence. The remaining $p$5 bits then serve as a pairwise independent hash (0705.4676).

5. Practical Applications: High-Throughput Matching and Cryptographic Protocols

The Rabin–Karp rolling hash is foundational in substring search and $p$6-gram analytics. It is deployed in applications such as plagiarism detection, document fingerprinting, and frequency analysis due to its $p$7 update and low false-positive rate in well-chosen parameter regimes. In cryptographic and privacy-preserving regimes, Rabin–Karp enables efficient zero-knowledge proofs for substring inclusion without text or pattern disclosure, as in zk-SNARK-based constructions (Li et al., 20 May 2025). In such protocols:

• The rolling hash function is instantiated within arithmetic circuits native to the proving system, with parameters chosen to match the underlying field, obviating explicit modular reduction.
• All internal hash values remain secret, and only compact, verifiable assertions of substring presence are revealed, ensuring both privacy and computational efficiency.

The rolling hash update integrates into circuit design with linear constraint complexity in $p$8, with succinct, zero-knowledge proofs generated for pattern matching—a method that scales efficiently to large input sizes (Li et al., 20 May 2025).

6. Performance Benchmarks and Memory-Throughput Trade-Offs

Comparative benchmarking yields empirical insights:

• Randomized Karp–Rabin (ID37): Fastest for uniformity-only tasks (e.g., up to 0.3 s for $p$9M $S$0-gram hashes), but has higher collision rates in large-scale tests; not pairwise independent.
• Polynomial (General, GF(2) with irreducible $S$1): Throughput of $S$2–$S$3 million updates per second; pairwise independent; higher memory cost if buffering is used.
• Polynomial (Cyclic): Throughput $S$4–$S$5 million updates per second; requires hash-bit dropping to achieve pairwise independence; memory-efficient (no buffer required).
• Non-recursive 3-wise independent schemes: Throughput is $S$6 per update; becomes less practical as window size $S$7 increases.

Memory overhead is dominated by symbol-to-random-value tables $S$8; the cost of exponential buffering arises only for certain polynomial schemes that require $S$9 storage to keep update complexity minimal (0705.4676).

Hash Family	Independence	Per-update Speed	Memory Cost
Randomized Karp–Rabin	Uniform only	Fastest	Small
Polynomial, General	Pairwise	Moderate	$H(S) = \sum_{j=0}^{m-1} S[j]\,b^{m-1-j}\;\bmod q$0 (optional)
Polynomial, Cyclic	Pairwise*	Fastest	$H(S) = \sum_{j=0}^{m-1} S[j]\,b^{m-1-j}\;\bmod q$1
Non-recursive 3-wise	$H(S) = \sum_{j=0}^{m-1} S[j]\,b^{m-1-j}\;\bmod q$2-wise	Slower ($H(S) = \sum_{j=0}^{m-1} S[j]\,b^{m-1-j}\;\bmod q$3)	Large for table

*After discarding $H(S) = \sum_{j=0}^{m-1} S[j]\,b^{m-1-j}\;\bmod q$4 bits.

7. Worked Example and Integration with Reversible and Privacy-Preserving Algorithms

For illustrative purposes, consider the text “abracadabra” and pattern “abra” with $H(S) = \sum_{j=0}^{m-1} S[j]\,b^{m-1-j}\;\bmod q$5, $H(S) = \sum_{j=0}^{m-1} S[j]\,b^{m-1-j}\;\bmod q$6, $H(S) = \sum_{j=0}^{m-1} S[j]\,b^{m-1-j}\;\bmod q$7:

• Precompute: $H(S) = \sum_{j=0}^{m-1} S[j]\,b^{m-1-j}\;\bmod q$8.
• $H(S) = \sum_{j=0}^{m-1} S[j]\,b^{m-1-j}\;\bmod q$9 is calculated recursively and found to be $$H(S) = (S[0]\,b^{m-1} + S[1]\,b^{m-2} + \cdots + S[m-1])\bmod q$$0.
• First window: matches directly.
• Next window: Compute $$H(S) = (S[0]\,b^{m-1} + S[1]\,b^{m-2} + \cdots + S[m-1])\bmod q$$1, then $$H(S) = (S[0]\,b^{m-1} + S[1]\,b^{m-2} + \cdots + S[m-1])\bmod q$$2.

In reversible algorithm design, the injectivity of the modular steps allows for clean, space-free construction without irreversible state updates. Within zk-SNARK circuits, parameters ($$H(S) = (S[0]\,b^{m-1} + S[1]\,b^{m-2} + \cdots + S[m-1])\bmod q$$3, $$H(S) = (S[0]\,b^{m-1} + S[1]\,b^{m-2} + \cdots + S[m-1])\bmod q$$4, $$H(S) = (S[0]\,b^{m-1} + S[1]\,b^{m-2} + \cdots + S[m-1])\bmod q$$5) are hardcoded, the input strings are private, and only the compiled proof of substring presence is revealed (Li et al., 20 May 2025, Glück et al., 2022).