Hash Combiners for Second Pre-image Resistance, Target Collision Resistance and Pre-image Resistance Have Long Output

Mittelbach, Arno

doi:10.1007/978-3-642-32928-9_29

Cited by 8 publications

(6 citation statements)

References 18 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In detail, Pietrzak [30] demonstrated that no collision robust combiner from two n-bit hash functions exists with output length shorter than 2n − Θ(log n). A similar observation was recently made for (second) preimage resistance by Rjaško [32] and Mittelbach [26].…”

Section: Introductionsupporting

confidence: 85%

“…Pietrzak [30] proved that the output length of a collision secure black-box combiner is at least the sum of the output lengths of H 1 and H 2 (minus a logarithmic term in the output size of H 1 , H 2 ). A similar observation was recently made for second preimage and preimage resistance by Rjaško [32] and Mittelbach [26]. At ACNS 2013, Mittelbach elegantly lifted the security of combiners to the ideal model.…”

Section: Ideal Combiner Modelsupporting

confidence: 70%

See 1 more Smart Citation

Breaking and Fixing Cryptophia’s Short Combiner

Mennink

Preneel

2014

Cryptology and Network Security

View full text Add to dashboard Cite

A combiner is a construction formed out of two hash functions that is secure if one of the underlying functions is. Conventional combiners are known not to support short outputs: if the hash functions have n-bit outputs the combiner should have at least almost 2n bits of output in order to be robust for collision resistance (Pietrzak, CRYPTO 2008). Mittelbach (ACNS 2013) introduced a relaxed security model for combiners and presented "Cryptophia's short combiner," a rather delicate construction of an n-bit combiner that achieves optimal collision, preimage, and second preimage security. We re-analyze Cryptophia's combiner and show that a collision can be found in two queries and a second preimage in one query, invalidating the claimed results. We additionally propose a way to fix the design in order to re-establish the original security results.

show abstract

Section: Introductionsupporting

confidence: 85%

Section: Ideal Combiner Modelsupporting

confidence: 70%

Breaking and Fixing Cryptophia’s Short Combiner

Mennink

Preneel

2014

Cryptology and Network Security

View full text Add to dashboard Cite

show abstract

“…This question was first posed by Boneh and Boyen in [BB06] and has since been answered negatively [BB06, CRS + 07, Pie07, Pie08]: combiners, robust for collision resistance, with significantly shorter output length than the concatenation combiner do not exist. A similar result was also proved for second pre-image resistance, target collision resistance and pre-image resistance [Rja09,Mit12].…”

Section: Short Combiners For Collision Resistancesupporting

confidence: 48%

“…This observation lead to the question whether short hash-function combiners (combiners with an output length significantly shorter than that of the concatenation combiner) that are robust for collision resistance exist [BB06]. It has been shown that this is not the case, i.e., there exists a lower bound on the output length for combiners that are robust for collision resistance as well as for related properties [BB06, CRS + 07, Pie07,Pie08,Mit12] where the lower bound is roughly the output length achieved by the concatenation combiner.…”

Section: Introductionmentioning

confidence: 99%

Cryptophia’s Short Combiner for Collision-Resistant Hash Functions

Mittelbach

2013

Applied Cryptography and Network Security

Self Cite

View full text Add to dashboard Cite

Abstract.A combiner for collision-resistant hash functions takes two functions as input and implements a hash function with the guarantee that it is collision-resistant if one of the functions is. It has been shown that such a combiner cannot have short output (Pietrzak, Crypto 2008); that is, its output length is lower bounded by roughly 2n if the ingoing functions output n-bit hash values. In this paper, we present two novel definitions for hash function combiners that allow to bypass the lower bound: the first is an extended semi-black-box definition. The second is a new game-based, fully black-box definition which allows to better analyze combiners in idealized settings such as the random-oracle model or indifferentiability framework (Maurer, Renner, and Holenstein, TCC 2004). We then present a new combiner which is robust for pseudorandom functions (in the traditional sense), which does not increase the output length of its underlying functions and which is collision-resistant in the indifferentiability setting. Our combiner is particularly relevant in practical scenarios, where security proofs are often given in idealized models, and our combiner, in the same idealized model, yields strong security guarantees while remaining short.

show abstract

“…The notion was mostly studied via the black-box reduction model. A series of results have showed that robust combiners for collision resistance and preimage resistance cannot have an output length significantly shorter than the sum of the output length of the underlying hash functions [3,32,33,28]. Since the XOR combiner is length preserving, this shows that it is not robust for collision resistance and preimage resistance.…”

Section: Related Workmentioning

confidence: 99%

The Sum Can Be Weaker Than Each Part

Leurent

Wang

2015

Lecture Notes in Computer Science

View full text Add to dashboard Cite

In this paper we study the security of summing the outputs of two independent hash functions, in an effort to increase the security of the resulting design, or to hedge against the failure of one of the hash functions. The exclusive-or (XOR) combiner H1(M)⊕H2(M) is one of the two most classical combiners, together with the concatenation combiner H1(M) H2(M). While the security of the concatenation of two hash functions is well understood since Joux's seminal work on multicollisions, the security of the sum of two hash functions has been much less studied. The XOR combiner is well known as a good PRF and MAC combiner, and is used in practice in TLS versions 1.0 and 1.1. In a hash function setting, Hoch and Shamir have shown that if the compression functions are modeled as random oracles, or even weak random oracles (i.e. they can easily be inverted-in particular H1 and H2 offer no security), H1 ⊕ H2 is indifferentiable from a random oracle up to the birthday bound. In this work, we focus on the preimage resistance of the sum of two narrowpipe n-bit hash functions, following the Merkle-Damgård or HAIFA structure (the internal state size and the output size are both n bits). We show a rather surprising result: the sum of two such hash functions, e.g. SHA-512 ⊕ Whirlpool, can never provide n-bit security for preimage resistance. More precisely, we present a generic preimage attack with a complexity ofÕ(2 5n/6). While it is already known that the XOR combiner is not preserving for preimage resistance (i.e. there might be some instantiations where the hash functions are secure but the sum is not), our result is much stronger: for any narrow-pipe functions, the sum is not preimage resistant. Besides, we also provide concrete preimage attacks on the XOR combiner (and the concatenation combiner) when one or both of the compression functions are weak; this complements Hoch and Shamir's proof by showing its tightness for preimage resistance. Of independent interests, one of our main technical contributions is a novel structure to control simultaneously the behavior of independent hash computations which share the same input message. We hope that breaking the pairwise relationship between their internal states will have applications in related settings.

show abstract

Hash Combiners for Second Pre-image Resistance, Target Collision Resistance and Pre-image Resistance Have Long Output

Cited by 8 publications

References 18 publications

Breaking and Fixing Cryptophia’s Short Combiner

Breaking and Fixing Cryptophia’s Short Combiner

Cryptophia’s Short Combiner for Collision-Resistant Hash Functions

The Sum Can Be Weaker Than Each Part

Contact Info

Product

Resources

About