Does The Order Of Hash Inputs Matter In Terms Of Uniqueness And Distribution?

<cfscript>

	/**
	* I return a 2-tuple of the givens sources of entropy hashed together in two different
	* orders.
	* 
	* NOTE: Each hash is converted into a number and fit into the CANVAS SIZE range so
	* that it can be used a X/Y coordinate.
	*/
	public array function randInts() {

		var timeBytes = charsetDecode( getTickCount( "nano" ), "utf-8" );
		var counterBytes = charsetDecode( counter++, "utf-8" );
		var fingerprintBytes = charsetDecode( fingerprint, "utf-8" );
		var randomBytes = nextBytes( 32 );

		// Return a 2-tuple with the same inputs hashed in a different order.
		return([
			hashInputs([ timeBytes, counterBytes, fingerprintBytes, randomBytes ]),
			hashInputs([ randomBytes, fingerprintBytes, counterBytes, timeBytes ]),
		]);

	}

</cfscript>

<cfscript>

	// We're going to draw dots (1x1 rectangles) to two different canvas. Each canvas will
	// represent the results of hashing the SAME INPUTS in a DIFFERENT ORDER.
	canvasSize = 700;
	canvasOne = createCanvas( canvasSize )
	canvasTwo = createCanvas( canvasSize );

	loop times = 1000 {

		// Each call for rand-ints will return a 2-tuple in which each value is the result
		// of hashing the SAME INPUTS in a DIFFERNT ORDER. While the order of hash inputs
		// will clearly affect the absolute value, the goal here is to see if the input
		// order affects the CHARACTERISTICS of the value (ie, its randomness and general
		// distribution in a given space).
		xCoords = randInts();
		yCoords = randInts();

		canvasOne.drawRect( xCoords[ 1 ], yCoords[ 1 ], 1, 1, true );
		canvasTwo.drawRect( xCoords[ 2 ], yCoords[ 2 ], 1, 1, true );

	}

	canvasOne.writeToBrowser();
	canvasTwo.writeToBrowser();

</cfscript>

<cfscript>

	setting
		requestTimeout = 300
	;

	// Every hash will include an incremented counter value.
	counter = randRange( 0, 2057, "sha1prng" );
	// Every hash will include a hash of the SERVER scope, which includes product and
	// machine information such as the Host Name and the MAC address.
	fingerprint = hash( serializeJson( server ), "sha-256" );
	// Every hash will include a random selection of bytes, generated per hash.
	secureRandom = createObject( "java", "java.security.SecureRandom" )
		.init()
	;

	// Cache the Java class instances for use in the hashing functions.
	MessageDigestClass = createObject( "java", "java.security.MessageDigest" );
	BigIntegerClass = createObject( "java", "java.math.BigInteger" );

	// ------------------------------------------------------------------------------- //
	// ------------------------------------------------------------------------------- //

	// We're going to draw dots (1x1 rectangles) to two different canvas. Each canvas will
	// represent the results of hashing the SAME INPUTS in a DIFFERENT ORDER.
	canvasSize = 700;
	canvasOne = createCanvas( canvasSize )
	canvasTwo = createCanvas( canvasSize );

	loop times = 1000000 {

		// Each call for rand-ints will return a 2-tuple in which each value is the result
		// of hashing the SAME INPUTS in a DIFFERNT ORDER. While the order of hash inputs
		// will clearly affect the absolute value, the goal here is to see if the input
		// order affects the CHARACTERISTICS of the value (ie, its randomness and general
		// distribution in a given space).
		xCoords = randInts();
		yCoords = randInts();

		canvasOne.drawRect( xCoords[ 1 ], yCoords[ 1 ], 1, 1, true );
		canvasTwo.drawRect( xCoords[ 2 ], yCoords[ 2 ], 1, 1, true );

	}

	canvasOne.writeToBrowser();
	canvasTwo.writeToBrowser();

	// ------------------------------------------------------------------------------- //
	// ------------------------------------------------------------------------------- //

	/**
	* I return a 2-tuple of the givens sources of entropy hashed together in two different
	* orders.
	* 
	* NOTE: Each hash is converted into a number and fit into the CANVAS SIZE range so
	* that it can be used a X/Y coordinate.
	*/
	public array function randInts() {

		var timeBytes = charsetDecode( getTickCount( "nano" ), "utf-8" );
		var counterBytes = charsetDecode( counter++, "utf-8" );
		var fingerprintBytes = charsetDecode( fingerprint, "utf-8" );
		var randomBytes = nextBytes( 32 );

		// Return a 2-tuple with the same inputs hashed in a different order.
		return([
			hashInputs([ timeBytes, counterBytes, fingerprintBytes, randomBytes ]),
			hashInputs([ randomBytes, fingerprintBytes, counterBytes, timeBytes ]),
		]);

	}


	/**
	* I hash the given inputs, convert them to a number, and then modulus them into the
	* canvas size.
	*/
	public numeric function hashInputs( required array inputs ) {

		var digest = MessageDigestClass.getInstance( "sha-256" );

		for ( var value in inputs ) {

			digest.update( value );

		}

		var remainder = BigIntegerClass
			.init( digest.digest() )
			.remainder( BigIntegerClass.valueOf( canvasSize ) )
		;

		return( abs( remainder ) );

	}


	/**
	* I return an array of random bytes using the Secure Random class.
	*/
	public array function nextBytes( required numeric length ) {

		// Create a Java byte array of the desired length.
		var bytes = [];
		arrayResize( bytes, length );
		arraySet( bytes, 1, length, 0 );

		// Write the random bytes into the byte array.
		var javaBytes = javaCast( "byte[]", bytes );
		secureRandom.nextBytes( javaBytes );

		return( javaBytes );

	}


	/**
	* I create and configure a ColdFusion image of the given size.
	*/
	public any function createCanvas( required numeric size ) {

		var canvas = imageNew( "", size, size, "rgb", "ffffff" );
		canvas.setDrawingColor( "000000" );
		canvas.setAntialiasing( "off" );

		return( canvas );

	}

</cfscript>