Compositions of linear functions and applications to hashing

Abstract

ABSTRACT. Cayley hash functions are based on a simple idea of using a pair of (semi)group elements, A and B, to hash the 0 and 1 bit, respectively, and then to hash an arbitrary bit string in the natural way, by using multiplication of elements in the (semi)group. In this paper, we focus on hashing with linear functions of one variable over F p . The corresponding hash functions are very efficient. In particular, we show that hashing a bit string of length n with our method requires, in general, at most 2n multiplications in F p , but with particular pairs of linear functions that we suggest, one does not need to perform any multiplications at all. We also give explicit lower bounds on the length of collisions for hash functions corresponding to these particular pairs of linear functions over F p .

Recent Developments in Cayley Hash Functions

“…This paper proves that the hash function proposed by Gaffari and Mustaghim [6] is not collision-resistant, which uses the hash proposed by Shpilrain and Sosnovski [16] that has been proven insecure by Monico [10]. To show that Gaffari and Mustaghim's is also insecure, we apply Monico's algorithm to find second-preimages for the Shpilrain-Sosnovski hash function to produce collisions for the Gaffari and Mustaghim's hash function.…”

“…The Shpilrain-Sosnovski hash function. In [16], the authors presented a Cayley hash function that uses linear functions in one variable over under matrix multiplication. Using results about the freeness of upper triangular matrices by Cassaigne at al.…”

“…The Ghaffari-Mostaghim hash function. As discussed in [16], preimages can be easily computed for short messages in the Shpilrain-Sosnovski hash, and the option suggested to avoid it is using padding.…”

“…

The hash function proposed by Shpilrain and Sosnovski (2016), based on affine maps in one variable over a finite field, was proven insecure. This paper shows that the variation proposed by Ghaffari and Mostaghim (2018) that uses Shpilrain and Sosnovski's hash is also insecure.

…”