Cryptography and Coding

Volume 7089 of the series Lecture Notes in Computer Science pp 152-171

The Symbiosis between Collision and Preimage Resistance

  • Elena AndreevaAffiliated withESAT/SCD–COSIC, Dept. of Electrical Engineering, Katholieke Universiteit Leuven and IBBT
  • , Martijn StamAffiliated withDepartment of Computer Science, University of Bristol

* Final gross prices may vary according to local VAT.

Get Access


We revisit the definitions of preimage resistance, focussing on the question of finding a definition that is simple enough to prove security against, yet flexible enough to be of use for most applications. We give an in-depth analysis of existing preimage resistance notions, introduce several new notions, and establish relations and separations between the known and new preimage notions. This establishes a clear separation between domain-oriented and range-oriented preimage resistance notions. For the former an element is chosen from the domain and hashed to form the target digest; for the latter the target digest is chosen directly from the range.

In particular, we show that Rogaway and Shrimpton’s notion of everywhere preimage resistance on its own is less powerful than previously thought. However, we prove that in conjunction with collision resistance, everywhere preimage resistance implies ‘ordinary’ (domain-based) preimage resistance. We show the implications of our result for iterated hash functions and hash chains, where the latter is related to the Winternitz one-time signature scheme.