Cryptology ePrint Archive: Report 2009/077

On the Security of Iterated Hashing based on Forgery-resistant Compression Functions

Charles Bouillaguet and Orr Dunkelman and Pierre-Alain Fouque and Antoine Joux

Abstract: In this paper we re-examine the security notions suggested for hash functions, with an emphasis on the delicate notion of second preimage resistance. We start by showing that, in the random oracle model, both Merkle-Damgaard and HAIFA achieve second preimage resistance beyond the birthday bound, and actually up to the level of known generic attacks, hence demonstrating the optimality of HAIFA in this respect. We then try to distill a more elementary requirement out of the compression function to get some insight on the properties it should have to guarantee the second preimage resistance of its iteration. We show that if the (keyed) compression function is a secure FIL-MAC then the Merkle-Damgaard mode of iteration (or HAIFA) still maintains the same level of second preimage resistance. We conclude by showing that this ``new'' assumption (or security notion) implies the recently introduced Preimage-Awareness while ensuring all other classical security notions for hash functions.

Category / Keywords: foundations /

Date: received 16 Feb 2009

Contact author: charles bouillaguet at ens fr

Available format(s): PDF | BibTeX Citation

Version: 20090216:205310 (All versions of this report)

Short URL: ia.cr/2009/077

Discussion forum: Show discussion | Start new discussion