Second preimages on n-bit hash functions for much less than 2n work

Authors:
John Kelsey;Bruce Schneier
Affiliations:
National Institute of Standards and Technology;Counterpane Internet Security, Inc
Venue:
EUROCRYPT'05 Proceedings of the 24th annual international conference on Theory and Applications of Cryptographic Techniques
Year:
2005

Citing 12
Cited 82

A fast software one-way hash function

Journal of Cryptology
Confirmation that some hash functions are not collision free

EUROCRYPT '90 Proceedings of the workshop on the theory and application of cryptographic techniques on Advances in cryptology
Differential cryptanalysis of the data encryption standard

Differential cryptanalysis of the data encryption standard
Hash functions based on block ciphers: a synthetic approach

CRYPTO '93 Proceedings of the 13th annual international cryptology conference on Advances in cryptology
Handbook of Applied Cryptography

Handbook of Applied Cryptography
Black-Box Analysis of the Block-Cipher-Based Hash-Function Constructions from PGV

CRYPTO '02 Proceedings of the 22nd Annual International Cryptology Conference on Advances in Cryptology
A Design Principle for Hash Functions

CRYPTO '89 Proceedings of the 9th Annual International Cryptology Conference on Advances in Cryptology
One Way Hash Functions and DES

CRYPTO '89 Proceedings of the 9th Annual International Cryptology Conference on Advances in Cryptology
Improving Implementable Meet-in-the-Middle Attacks by Orders of Magnitude

CRYPTO '96 Proceedings of the 16th Annual International Cryptology Conference on Advances in Cryptology
A Practice-Oriented Treatment of Pseudorandom Number Generators

EUROCRYPT '02 Proceedings of the International Conference on the Theory and Applications of Cryptographic Techniques: Advances in Cryptology
RIPEMD-160: A Strengthened Version of RIPEMD

Proceedings of the Third International Workshop on Fast Software Encryption
TIGER: A Fast New Hash Function

Proceedings of the Third International Workshop on Fast Software Encryption

A survey of recent developments in cryptographic algorithms for smart cards

Computer Networks: The International Journal of Computer and Telecommunications Networking
MAME: A Compression Function with Reduced Hardware Requirements

CHES '07 Proceedings of the 9th international workshop on Cryptographic Hardware and Embedded Systems
Current Status of Japanese Government PKI Systems

EuroPKI '08 Proceedings of the 5th European PKI workshop on Public Key Infrastructure: Theory and Practice
Collisions on SHA-0 in One Hour

Fast Software Encryption
MD4 is Not One-Way

Fast Software Encryption
Improved Indifferentiability Security Analysis of chopMD Hash Function

Fast Software Encryption
Looking Back at a New Hash Function

ACISP '08 Proceedings of the 13th Australasian conference on Information Security and Privacy
On the Strength of the Concatenated Hash Combiner When All the Hash Functions Are Weak

ICALP '08 Proceedings of the 35th international colloquium on Automata, Languages and Programming, Part II
Hash Functions and RFID Tags: Mind the Gap

CHES '08 Proceeding sof the 10th international workshop on Cryptographic Hardware and Embedded Systems
Preimages for Reduced SHA-0 and SHA-1

CRYPTO 2008 Proceedings of the 28th Annual conference on Cryptology: Advances in Cryptology
Collisions for RC4-Hash

ISC '08 Proceedings of the 11th international conference on Information Security
Side Channel Analysis of Some Hash Based MACs: A Response to SHA-3 Requirements

ICICS '08 Proceedings of the 10th International Conference on Information and Communications Security
How to Use Merkle-Damgård -- On the Security Relations between Signature Schemes and Their Inner Hash Functions

ProvSec '08 Proceedings of the 2nd International Conference on Provable Security
Faster Multicollisions

INDOCRYPT '08 Proceedings of the 9th International Conference on Cryptology in India: Progress in Cryptology
Slide Attacks on a Class of Hash Functions

ASIACRYPT '08 Proceedings of the 14th International Conference on the Theory and Application of Cryptology and Information Security: Advances in Cryptology
How to Fill Up Merkle-Damgård Hash Functions

ASIACRYPT '08 Proceedings of the 14th International Conference on the Theory and Application of Cryptology and Information Security: Advances in Cryptology
Classification of Hash Functions Suitable for Real-Life Systems

IEICE Transactions on Fundamentals of Electronics, Communications and Computer Sciences
A Single-Key Domain Extender for Privacy-Preserving MACs and PRFs

Information Security and Cryptology --- ICISC 2008
Twister --- A Framework for Secure and Fast Hash Functions

ISPEC '09 Proceedings of the 5th International Conference on Information Security Practice and Experience
On Randomizing Hash Functions to Strengthen the Security of Digital Signatures

EUROCRYPT '09 Proceedings of the 28th Annual International Conference on Advances in Cryptology: the Theory and Applications of Cryptographic Techniques
Cryptanalysis of MDC-2

EUROCRYPT '09 Proceedings of the 28th Annual International Conference on Advances in Cryptology: the Theory and Applications of Cryptographic Techniques
Finding Preimages in Full MD5 Faster Than Exhaustive Search

EUROCRYPT '09 Proceedings of the 28th Annual International Conference on Advances in Cryptology: the Theory and Applications of Cryptographic Techniques
A Double-Piped Mode of Operation for MACs, PRFs and PROs: Security beyond the Birthday Barrier

EUROCRYPT '09 Proceedings of the 28th Annual International Conference on Advances in Cryptology: the Theory and Applications of Cryptographic Techniques
The State of Hash Functions and the NIST SHA-3 Competition

Information Security and Cryptology
Digital signature and hash function irregularity

TELE-INFO'09 Proceedings of the 8th Wseas international conference on Telecommunications and informatics
On the Weak Ideal Compression Functions

ACISP '09 Proceedings of the 14th Australasian Conference on Information Security and Privacy
Preimages for Step-Reduced SHA-2

ASIACRYPT '09 Proceedings of the 15th International Conference on the Theory and Application of Cryptology and Information Security: Advances in Cryptology
Security of Cyclic Double Block Length Hash Functions

Cryptography and Coding '09 Proceedings of the 12th IMA International Conference on Cryptography and Coding
Constructing an ideal hash function from weak ideal compression functions

SAC'06 Proceedings of the 13th international conference on Selected areas in cryptography
Second preimages for iterated hash functions and their implications on MACs

ACISP'07 Proceedings of the 12th Australasian conference on Information security and privacy
On building hash functions from multivariate quadratic equations

ACISP'07 Proceedings of the 12th Australasian conference on Information security and privacy
Non-interactive manual channel message authentication based on eTCR hash functions

ACISP'07 Proceedings of the 12th Australasian conference on Information security and privacy
Domain extension of public random functions: beyond the birthday Barrier

CRYPTO'07 Proceedings of the 27th annual international cryptology conference on Advances in cryptology
Seven-property-preserving iterated hashing: ROX

ASIACRYPT'07 Proceedings of the Advances in Crypotology 13th international conference on Theory and application of cryptology and information security
Cryptanalysis of GRINDAHL

ASIACRYPT'07 Proceedings of the Advances in Crypotology 13th international conference on Theory and application of cryptology and information security
On the indifferentiability of the sponge construction

EUROCRYPT'08 Proceedings of the theory and applications of cryptographic techniques 27th annual international conference on Advances in cryptology
Second preimage attacks on dithered hash functions

EUROCRYPT'08 Proceedings of the theory and applications of cryptographic techniques 27th annual international conference on Advances in cryptology
Analysis of Zipper as a hash function

ISPEC'08 Proceedings of the 4th international conference on Information security practice and experience
How (not) to efficiently dither blockcipher-based hash functions?

AFRICACRYPT'08 Proceedings of the Cryptology in Africa 1st international conference on Progress in cryptology
Linear-XOR and additive checksums don't protect Damgård-Merkle hashes from generic attacks

CT-RSA'08 Proceedings of the 2008 The Cryptopgraphers' Track at the RSA conference on Topics in cryptology
On hashing with tweakable ciphers

ICC'09 Proceedings of the 2009 IEEE international conference on Communications
TWISTERπ – a framework for secure and fast hash functions

International Journal of Applied Cryptography
Relation between successfulness of birthday attack on digital signature and hash function irregularity

WSEAS Transactions on Information Science and Applications
A multi purpose web-based contractual management system

WSEAS Transactions on Information Science and Applications
Domain extension for enhanced target collision-resistant hash functions

FSE'10 Proceedings of the 17th international conference on Fast software encryption
Enhanced security notions for dedicated-key hash functions: definitions and relationships

FSE'10 Proceedings of the 17th international conference on Fast software encryption
Preimage attacks on reduced steps of ARIRANG and PKC98-hash

ICISC'09 Proceedings of the 12th international conference on Information security and cryptology
Improved preimage attack for 68-step HAS-160

ICISC'09 Proceedings of the 12th international conference on Information security and cryptology
Second-preimage analysis of reduced SHA-1

ACISP'10 Proceedings of the 15th Australasian conference on Information security and privacy
Some observations on indifferentiability

ACISP'10 Proceedings of the 15th Australasian conference on Information security and privacy
(Second) preimage attacks on step-reduced RIPEMD/RIPEMD-128 with a new local-collision approach

CT-RSA'11 Proceedings of the 11th international conference on Topics in cryptology: CT-RSA 2011
An improved algebraic attack on Hamsi-256

FSE'11 Proceedings of the 18th international conference on Fast software encryption
Meet-in-the-middle preimage attacks on AES hashing modes and an application to whirlpool

FSE'11 Proceedings of the 18th international conference on Fast software encryption
Linear analysis of reduced-round cubehash

ACNS'11 Proceedings of the 9th international conference on Applied cryptography and network security
Variants of multicollision attacks on iterated hash functions

Inscrypt'10 Proceedings of the 6th international conference on Information security and cryptology
Pseudo-cryptanalysis of Luffa

Inscrypt'10 Proceedings of the 6th international conference on Information security and cryptology
Preimage attacks against PKC98-Hash and HAS-V

ICISC'10 Proceedings of the 13th international conference on Information security and cryptology
A lightweight 256-bit hash function for hardware and low-end devices: lesamnta-LW

ICISC'10 Proceedings of the 13th international conference on Information security and cryptology
Combining compression functions and block cipher-based hash functions

ASIACRYPT'06 Proceedings of the 12th international conference on Theory and Application of Cryptology and Information Security
RC4-hash: a new hash function based on RC4

INDOCRYPT'06 Proceedings of the 7th international conference on Cryptology in India
Some attacks against a double length hash proposal

ASIACRYPT'05 Proceedings of the 11th international conference on Theory and Application of Cryptology and Information Security
A failure-friendly design principle for hash functions

ASIACRYPT'05 Proceedings of the 11th international conference on Theory and Application of Cryptology and Information Security
Increasing the flexibility of the herding attack

Information Processing Letters
Breaking the ICE – finding multicollisions in iterated concatenated and expanded (ICE) hash functions

FSE'06 Proceedings of the 13th international conference on Fast Software Encryption
Multi-property-preserving domain extension using polynomial-based modes of operation

EUROCRYPT'10 Proceedings of the 29th Annual international conference on Theory and Applications of Cryptographic Techniques
Strengthening digital signatures via randomized hashing

CRYPTO'06 Proceedings of the 26th annual international conference on Advances in Cryptology
Cryptanalysis of the 10-round hash and full compression function of SHAvite-3-512

AFRICACRYPT'10 Proceedings of the Third international conference on Cryptology in Africa
Collision-Resistant no more: hash-and-sign paradigm revisited

PKC'06 Proceedings of the 9th international conference on Theory and Practice of Public-Key Cryptography
Herding hash functions and the nostradamus attack

EUROCRYPT'06 Proceedings of the 24th annual international conference on The Theory and Applications of Cryptographic Techniques
Constructing secure hash functions by enhancing merkle-damgård construction

ACISP'06 Proceedings of the 11th Australasian conference on Information Security and Privacy
Cryptanalysis of t-function-based hash functions

ICISC'06 Proceedings of the 9th international conference on Information Security and Cryptology
The first 30 years of cryptographic hash functions and the NIST SHA-3 competition

CT-RSA'10 Proceedings of the 2010 international conference on Topics in Cryptology
SP 800-107. Recommendation for Applications Using Approved Hash Algorithms

SP 800-107. Recommendation for Applications Using Approved Hash Algorithms
Cryptanalyses on a merkle-damgård based MAC -- almost universal forgery and distinguishing-h attacks

EUROCRYPT'12 Proceedings of the 31st Annual international conference on Theory and Applications of Cryptographic Techniques
On the complexity of the herding attack and some related attacks on hash functions

Designs, Codes and Cryptography
Security analysis and comparison of the SHA-3 finalists BLAKE, grøstl, JH, keccak, and skein

AFRICACRYPT'12 Proceedings of the 5th international conference on Cryptology in Africa
The Grindahl hash functions

FSE'07 Proceedings of the 14th international conference on Fast Software Encryption
Security analysis of constructions combining FIL random oracles

FSE'07 Proceedings of the 14th international conference on Fast Software Encryption
(Pseudo) preimage attack on round-reduced grøstl hash function and others

FSE'12 Proceedings of the 19th international conference on Fast Software Encryption
Bicliques for preimages: attacks on skein-512 and the SHA-2 family

FSE'12 Proceedings of the 19th international conference on Fast Software Encryption
Investigating fundamental security requirements on whirlpool: improved preimage and collision attacks

ASIACRYPT'12 Proceedings of the 18th international conference on The Theory and Application of Cryptology and Information Security
On the security of tan et al. serverless RFID authentication and search protocols

RFIDSec'12 Proceedings of the 8th international conference on Radio Frequency Identification: security and privacy issues

Quantified Score

Hi-index	0.00

Visualization

Abstract

We expand a previous result of Dean [Dea99] to provide a second preimage attack on all n-bit iterated hash functions with Damgård-Merkle strengthening and n-bit intermediate states, allowing a second preimage to be found for a 2k-message-block message with about k × 2n/2+1 + 2n−k+1 work. Using RIPEMD-160 as an example, our attack can find a second preimage for a 260 byte message in about 2106 work, rather than the previously expected 2160 work. We also provide slightly cheaper ways to find multicollisions than the method of Joux [Jou04]. Both of these results are based on expandable messages–patterns for producing messages of varying length, which all collide on the intermediate hash result immediately after processing the message. We provide an algorithm for finding expandable messages for any n-bit hash function built using the Damgård-Merkle construction, which requires only a small multiple of the work done to find a single collision in the hash function.