Beyond Uniformity: Better Security/Efficiency Tradeoffs for Compression Functions

• Authors: Martijn Stam
• Venue: CRYPTO 2008 Proceedings of the 28th Annual conference on Cryptology: Advances in Cryptology
• Year: 2008

Suppose we are given a perfect n+ c-to-nbit compression function fand we want to construct a larger m+ s-to-sbit compression function Hinstead. What level of security, in particular collision resistance, can we expect from Hif it makes rcalls to f? We conjecture that typically collisions can be found in 2(nr+ cr茂戮驴 m)/(r+ 1)queries. This bound is also relevant for building a m+ s-to-sbit compression function based on a blockcipher with k-bit keys and n-bit blocks: simply set c= k, or c= 0 in case of fixed keys.We also exhibit a number of (conceptual) compression functions whose collision resistance is close to this bound. In particular, we consider the following four scenarios: 1A 2n-to-nbit compression function making two calls to an n-to-nbit primitive, providing collision resistance up to 2n/3/nqueries. This beats a recent bound by Rogaway and Steinberger that 2n/4queries to the underlying random n-to-nbit function suffice to find collisions in any rate-1/2 compression function. In particular, this shows that Rogaway and Steinberger's recent bound of 2(nr茂戮驴 m茂戮驴 s/2)/r)queries (for c= 0) crucially relies upon a uniformity assumption; a blanket generalization to arbitrary compression functions would be incorrect.1A 3n-to-2nbit compression function making a single call to a 3n-to-nbit primitive, providing collision resistance up to 2nqueries.1A 3n-to-2nbit compression function making two calls to a 2n-to-nbit primitive, providing collision resistance up to 2nqueries.1A single call compression function with parameters satisfying m≤ n+ c, n≤ s, c≤ m. This result provides a tradeoff between how many bits you can compress for what level of security given a single call to an n+ c-to-nbit random function.