Hash Combiners for Second Pre-image Resistance, Target Collision Resistance and Pre-image Resistance Have Long Output
- 948 Downloads
A (k,l) hash-function combiner for property P is a construction that, given access to l hash functions, yields a single cryptographic hash function which has property P as long as at least k out of the l hash functions have that property. Hash function combiners are used to hedge against the failure of one or more of the individual components. One example of the application of hash function combiners are the previous versions of the TLS and SSL protocols [7,6].
The concatenation combiner which simply concatenates the outputs of all hash functions is an example of a robust combiner for collision resistance. However, its output length is, naturally, significantly longer than each individual hash-function output, while the security bounds are not necessarily stronger than that of the strongest input hash-function. In 2006 Boneh and Boyen asked whether a robust black-box combiner for collision resistance can exist that has an output length which is significantly less than that of the concatenation combiner . Regrettably, this question has since been answered in the negative for fully black-box constructions (where hash function and adversary access is being treated as black-box), that is, combiners (in this setting) for collision resistance roughly need at least the length of the concatenation combiner to be robust [2,3,11,12].
In this paper we examine weaker notions of collision resistance, namely: second pre-image resistance and target collision resistance  and pre-image resistance. As a generic brute-force attack against any of these would take roughly 2 n queries to an n-bit hash function, in contrast to only 2 n/2 queries it would take to break collision resistance (due to the birthday bound), this might indicate that combiners for weaker notions of collision resistance can exist which have a significantly shorter output than the concatenation combiner (which is, naturally, also robust for these properties). Regrettably, this is not the case.
Keywordshash functions combiners collision resistance second pre-image resistance target collision resistance pre-image resistance
Unable to display preview. Download preview PDF.
- 4.De Cannière, C., Rechberger, C.: Preimages for Reduced SHA-0 and SHA-1. In: Wagner, D. (ed.) CRYPTO 2008. LNCS, vol. 5157, pp. 179–202. Springer, Heidelberg (2008)Google Scholar
- 6.Dierks, T., Rescorla, E.: The Transport Layer Security (TLS) Protocol Version 1.2. RFC 5246 (Proposed Standard) (August 2008), http://www.ietf.org/rfc/rfc5246.txt, updated by RFCs 5746, 5878, 6176
- 7.Freier, A., Karlton, P., Kocher, P.: The Secure Sockets Layer (SSL) Protocol Version 3.0. RFC 6101 (Historic) (August 2011), http://www.ietf.org/rfc/rfc6101.txt
- 8.Mittelbach, A.: Hash combiners for second pre-image resistance, target collision resistance and pre-image resistance have long output (full version). Cryptology ePrint Archive, Report 2012/354 (2012), http://eprint.iacr.org/
- 9.Naor, M., Yung, M.: Universal one-way hash functions and their cryptographic applications. In: 21st ACM STOC Annual ACM Symposium on Theory of Computing, May 15–17, pp. 33–43. ACM Press, Seattle (1989)Google Scholar
- 10.Pietrzak, K.: Compression from collisions, or why CRHF combiners have a long output (full version)Google Scholar
- 12.Pietrzak, K.: Compression from Collisions, or Why CRHF Combiners Have a Long Output. In: Wagner, D. (ed.) CRYPTO 2008. LNCS, vol. 5157, pp. 413–432. Springer, Heidelberg (2008)Google Scholar
- 14.Rjaško, M.: On existence of robust combiners for cryptographic hash functions. In: ITAT, pp. 71–76 (2009)Google Scholar
- 15.Rogaway, P., Shrimpton, T.: Cryptographic Hash-Function Basics: Definitions, Implications, and Separations for Preimage Resistance, Second-Preimage Resistance, and Collision Resistance. In: Roy, B., Meier, W. (eds.) FSE 2004. LNCS, vol. 3017, pp. 371–388. Springer, Heidelberg (2004)CrossRefGoogle Scholar
- 19.Wang, X., Yin, Y.L., Yu, H.: Finding Collisions in the Full SHA-1. In: Shoup, V. (ed.) CRYPTO 2005. LNCS, vol. 3621, pp. 17–36. Springer, Heidelberg (2005)Google Scholar