**Compression Function Design Principles Supporting Variable Output Lengths from a Single Small Function**

*Donghoon Chang, Mridul Nandi, Jesang Lee, Jaechul Sung and Seokhie Hong*

**Abstract: **In this paper, we introduce new compression function design principles supporting variable output lengths (multiples of size $n$).
They are based on a function or block cipher with an $n$-bit output size. In the case of the compression function with a $(t+1)n$-bit output size, in the random oracle and ideal cipher models, their maximum advantages from the perspective of collision resistance are $O(\frac{t^2q}{2^{tn}}+\frac{q^2}{2^{(t+1)n}})$. In the case of $t=1$, the advantage is near-optimal. In the case of $t>1$, the advantage is optimal.

**Category / Keywords: **Hash function, Random oracle, Ideal cipher model.

**Date: **received 30 Oct 2007, last revised 18 Jun 2008

**Contact author: **pointchang at gmail com

**Available format(s): **Postscript (PS) | Compressed Postscript (PS.GZ) | PDF | BibTeX Citation

**Version: **20080618:063129 (All versions of this report)

**Short URL: **ia.cr/2007/416

**Discussion forum: **Show discussion | Start new discussion

[ Cryptology ePrint archive ]