Differential Cryptanalysis of Hash Functions

Abstract

Snefru[21] is designed to be a cryptographically strong hash function which hashes messages of arbitrary length into m-bit values (typically 128 bits). The messages are divided into (512 — m)-bit chunks and each chunk is mixed with the hashed value computed so far by a randomizing function H. The function H takes a 512-bit input composed of the previous hashed value and the next chunk and calculates an m-bit output. The new hashed value is the output of H. More formally, for any 1 ≤ i ≤ #c:

$${{h}_{i}} = H({{h}_{{i - 1}}}\parallel {{c}_{i}})$$

where #c is the number of chunks, ‘‖’ is the concatenation operator of bit vectors, c _i is chunk number i and h₀ is an m-bit vector of zeroes. The final output is:

$${\text{output = H(}}{{h}_{{\# c}}}\parallel {\text{length}} {\text{of}} {\text{message}} {\text{in}} {\text{bits)}}{\text{.}}$$