Second preimages on n-bit hash functions for much less than 2^n work

by John Kelsey , Bruce Schneier

Citations:

11 - 2 self

User correction supplied by mph

Datum	Value	Source
TITLE	Second preimages on n-bit hash functions for much less than 2^n work	user correction
AUTHOR NAME	John Kelsey	user correction
AUTHOR AFFIL	National Institute of Standards and Technology	user correction
AUTHOR NAME	Bruce Schneier	user correction
ABSTRACT	We expand a previous result of Dean [Dea99] to provide a second preimage attack on all n-bit iterated hash functions with Damgård-Merkle strengthening and n-bit intermediate states, allowing a second preimage to be found for a 2 k-message-block message with about k × 2 n/2+1 +2 n−k+1 work. Using RIPEMD-160 as an example, our attack can find a second preimage for a 2^60 byte message in about 2^106 work, rather than the previously expected 2^160 work. We also provide slightly cheaper ways to find multicollisions than the method of Joux [Jou04]. Both of these results are based on expandable messages–patterns for producing messages of varying length, which all collide on the intermediate hash result immediately after processing the message. We provide an algorithm for finding expandable messages for any n-bit hash function built using the Damgård-Merkle construction, which requires only a small multiple of the work done to find a single collision in the hash function.	user correction
CITATIONS	25 found	ParsCit 1.0