Collision Resistance of Double-Block-Length Hash Function against Free-Start Attack
Summary :
In this article, we discuss the security of double-block-length (DBL) hash functions against the free-start collision attack. We focus on the DBL hash functions composed of compression functions of the form F(x) = (f(x), f(p(x))), where f is a smaller compression function and p is a permutation. We first show, in the random oracle model, that a significantly good upper bound can be obtained on the success probability of the free-start collision attack with sufficient conditions on p and the set of initial values. We also show that a similar upper bound can be obtained in the ideal cipher model if f is composed of a block cipher.
- Publication
- IEICE TRANSACTIONS on Fundamentals Vol.E91-A No.1 pp.74-82
- Publication Date
- 2008/01/01
- Publicized
- Online ISSN
- 1745-1337
- DOI
- 10.1093/ietfec/e91-a.1.74
- Type of Manuscript
- Special Section PAPER (Special Section on Cryptography and Information Security)
- Category
- Hash Functions
Authors
Keyword
Latest Issue
Copyrights notice of machine-translated contents
The copyright of the original papers published on this site belongs to IEICE. Unauthorized use of the original or translated papers is prohibited. See IEICE Provisions on Copyright for details.
Cite this
Copy
Shoichi HIROSE, "Collision Resistance of Double-Block-Length Hash Function against Free-Start Attack" in IEICE TRANSACTIONS on Fundamentals,
vol. E91-A, no. 1, pp. 74-82, January 2008, doi: 10.1093/ietfec/e91-a.1.74.
Abstract: In this article, we discuss the security of double-block-length (DBL) hash functions against the free-start collision attack. We focus on the DBL hash functions composed of compression functions of the form F(x) = (f(x), f(p(x))), where f is a smaller compression function and p is a permutation. We first show, in the random oracle model, that a significantly good upper bound can be obtained on the success probability of the free-start collision attack with sufficient conditions on p and the set of initial values. We also show that a similar upper bound can be obtained in the ideal cipher model if f is composed of a block cipher.
URL: https://global.ieice.org/en_transactions/fundamentals/10.1093/ietfec/e91-a.1.74/_p
Copy
@ARTICLE{e91-a_1_74,
author={Shoichi HIROSE, },
journal={IEICE TRANSACTIONS on Fundamentals},
title={Collision Resistance of Double-Block-Length Hash Function against Free-Start Attack},
year={2008},
volume={E91-A},
number={1},
pages={74-82},
abstract={In this article, we discuss the security of double-block-length (DBL) hash functions against the free-start collision attack. We focus on the DBL hash functions composed of compression functions of the form F(x) = (f(x), f(p(x))), where f is a smaller compression function and p is a permutation. We first show, in the random oracle model, that a significantly good upper bound can be obtained on the success probability of the free-start collision attack with sufficient conditions on p and the set of initial values. We also show that a similar upper bound can be obtained in the ideal cipher model if f is composed of a block cipher.},
keywords={},
doi={10.1093/ietfec/e91-a.1.74},
ISSN={1745-1337},
month={January},}
Copy
TY - JOUR
TI - Collision Resistance of Double-Block-Length Hash Function against Free-Start Attack
T2 - IEICE TRANSACTIONS on Fundamentals
SP - 74
EP - 82
AU - Shoichi HIROSE
PY - 2008
DO - 10.1093/ietfec/e91-a.1.74
JO - IEICE TRANSACTIONS on Fundamentals
SN - 1745-1337
VL - E91-A
IS - 1
JA - IEICE TRANSACTIONS on Fundamentals
Y1 - January 2008
AB - In this article, we discuss the security of double-block-length (DBL) hash functions against the free-start collision attack. We focus on the DBL hash functions composed of compression functions of the form F(x) = (f(x), f(p(x))), where f is a smaller compression function and p is a permutation. We first show, in the random oracle model, that a significantly good upper bound can be obtained on the success probability of the free-start collision attack with sufficient conditions on p and the set of initial values. We also show that a similar upper bound can be obtained in the ideal cipher model if f is composed of a block cipher.
ER -
English
