---
title: Compute an unsalted system hash on demand
summary: Produce the canonical identity hash a validator can compare against a de-salted credential.
status: draft
owner: SAIF Platform Team
last_reviewed: 2026-10-02
library: SAIF.NetCore.SystemHash
reference_type: package
operation_id: OP-SH-02
trigger: A validating service needs the identity hash for comparison against a de-salted credential.
---

# Compute an unsalted system hash on demand

Produces the identity hash with no salting applied, so a validating service can compare it directly against the output of [De-salt and validate credential lifetime](validate-credential-lifetime.md).

| Field | Value |
| --- | --- |
| **Operation ID** | OP-SH-02 |
| **Trigger** | Direct call by a validating service (no in-repo caller). |
| **Inputs** | `type` (`SystemType`), `systemName` (string) |
| **Outputs** | 44-character Base64 SHA-256 string |
| **Primary components** | `SystemHashService.ComputeHashNow` |
| **Entry point** | `src/SAIF.NetCore.SystemHash/SAIF.NetCore.SystemHash/SAIF.NetCore.SystemHash/SystemHashService.cs` |

## Steps

1. Compute the deterministic identity hash for `type` and `systemName` ([BR-SH-01](../business-rules.md#br-sh-01-identity-hash-encoding), [BR-SH-02](../business-rules.md#br-sh-02-identity-string-uses-type-ordinal)):
   - Build the identity string `"{systemName}-{(int)type}"`, using the `SystemType` enum's integer ordinal, not its name.
   - Encode the identity string as UTF-16LE bytes (`Encoding.Unicode.GetBytes`).
   - Compute the SHA-256 digest of those bytes.
   - Base64-encode the digest (44 characters) and return it.

   See [Compute the identity hash](compute-identity-hash.md) for the full step-by-step detail of this delegation.

   > **Origin**: Step 1 is implemented in [Compute the identity hash](compute-identity-hash.md) and executed on behalf of this operation.
2. Return the identity hash with no salting applied ([BR-SH-05](../business-rules.md#br-sh-05-immediate-hash-is-unsalted)).

## Process flow

The following diagram shows the on-demand computation of the canonical, unsalted identity hash that an external validator uses for comparison against a de-salted credential; this operation performs no salting, lifetime checking, or comparison itself.

```mermaid
flowchart TD
	Start([Validator needs an identity hash]) --> Identity[Compute identity hash]
	Identity --> Return([Return unsalted identity hash])
```

## Failure and edge-case behavior
- There is no in-repo production caller of this operation; it exists for symmetry with the salted/validate path used by an external validating service.*

## Related documentation
- [Operations and processes](../operations-processes.md)
- [Business rules](../business-rules.md)

> **Note:** Statements marked with `*` were inferred from code structure, naming
> conventions, or contextual evidence where direct confirmation was not available
> in source artifacts.

## Sources
- `src/SAIF.NetCore.SystemHash/SAIF.NetCore.SystemHash/SAIF.NetCore.SystemHash/SystemHashService.cs`