A SECOND PREIMAGE ATTACK ON THE MERKLE-DAMGARD

SCHEME WITH A PERMUTATION FOR HASH FUNCTIONS

Shiwei Chen and Chenhui Jin

Institute of Information Science and Technology, Zhengzhou 450004, China

Keywords:

Hash functions, MD construction, MDP, Multicollisions, Second preimage attack, Computational complexity.

Abstract:

Using one kind of multicollsions of the Merkle-Damgard(MD) construction for hash functions proposed by

Kelsey and Schneier, this paper presents a second preimage attack on MDP construction which is a simple

variant of MD scheme with a permutation for hash functions. Then we prove that the computational complexity

of our second preimage attack is k × 2

n/2+1

+ 2

n−k

less than 2

where n is the size of the hash value and

+ k+ 1 is the length of the target message.

1 INTRODUCTION

A cryptographic hash function H maps a message M

with arbitrary length to a ﬁxed-length hash value h.

It has to satisfy the following three security require-

ments:

- Preimage resistance: For a given hash value h,

it is computationally infeasible to ﬁnd a message M

such that h = H(M);

- Second preimage resistance: For a given mes-

sage M, it is computationally infeasible to ﬁnd a sec-

ond message M

′

6= M such that H(M

′

) = H(M);

- Collision resistance: It is computationally infea-

sible to ﬁnd two different messages M

′

and M such

that H(M

′

) = H(M).

The resistance of a hash function to collision at-

tack or second preimage attack mainly depends on the

size n of the hash value. Regardless of how a hash

function is designed, an adversary will always be able

to ﬁnd a preimage or a second preimage after trying

different messages, or ﬁnd a collision pair after

n/2

trials according to the birthday attack. There-

fore, if the computational complexity of ﬁnding a col-

lision pair or a (second) preimage for a particular hash

function is less than what could be expected based

on the size of the hash value, then the hash function

is considered to be broken. Generally, a hash func-

tion includes two parts, that is, the compression func-

tion which maps a ﬁxed-length value to a ﬁxed-length

value, and the domain extension transform which can

transfer a message with arbitrary length to a ﬁxed-

length hash value. Aimed to these two parts, the re-

sults of analyzing on hash functions can be divided

into two kinds:

- Cryptanalytic attacks: Mainly apply to the com-

pression functions of the hash functions. Using the

internal properties of the compression functions, an

adversary can attack the hash functions. For exam-

ple, the collision attacks on MD-family proposed in

(Xiaoyun and Hongbo, 2005);

- Generic attacks: Apply to the domain extension

transforms directly with some assumptions on the

compression functions. Examples are long-message

second preimage attack(Kelsey and Schneier, 2005),

herding attack(Kelsey and Kohno, 2006) and the at-

tack on the MD with XOR-linear/additive checksum

in (Gauravaram and Kelsey, 2007).

Since Wang et al.(Xiaoyun and Hongbo, 2005)

presented the collision attacks on MD-family hash

functions and the recent results on the MD con-

struction, some cryptographers have been trying to

propose new domain extension transforms for hash

functions, such as MD with XOR-linear/additive

checksum(Gauravaram and Kelsey, 2007), ChopMD

construction (Coron et al., 2005), EMD construc-

tion(Bellare and Ristenpart, 2006), MD with a per-

mutation (MDP)(Hirose and Park, 2007), and so

on. In 2007, Praveen Gauravaram and John Kelsey

(Gauravaram and Kelsey, 2007) pointed out that the

MD with XOR-linear/additive checksum construc-

tion gained almost no security against generic at-

tacks. Coron et al.(Coron et al., 2005) presented

that the preﬁx-free MD and ChopMD were indiffer-

entiable from a random oracle and gave out the se-

curity bounds. However, Mihir Bellare and Thomas

Ristenpart(Bellare and Ristenpart, 2006) proved that

245

Chen S. and Jin C. (2009).

A SECOND PREIMAGE ATTACK ON THE MERKLE-DAMGARD SCHEME WITH A PERMUTATION FOR HASH FUNCTIONS.

In Proceedings of the International Conference on Security and Cryptography, pages 245-248

DOI: 10.5220/0002230202450248

 SciTePress

pseudorandom-oracle preserving did not imply the

collision-resistance preserving and presented that the

variants of MD construction presented in (Coron et

al., 2005) was not collision-resistance preserving. In

Asiacrypt 2007, Hirose et al.(Hirose and Park, 2007)

proposed a simple variant of the Merkle-Damgard

scheme with a permutation and analyzed its security

by using the indifferentiability formulism. However,

there is no paper discussing whether the MDP resists

the second preimage attack or not.

In this paper, using the multicollsions of MD con-

struction proposed in (Kelsey and Schneier, 2005), we

will present a second preimage attack on MDP con-

struction, the computational complexity of which is

less than what could be expected based on the size of

the hash value.

2 DESCRIPTION OF MDP

CONSTRUCTION AND

NOTATIONS

Let f : {0,1}

× {0, 1}

→ {0,1}

be a compression

function and M be a l-block b-bit message. We can

describe the MD

below, which is MD construction

with the compression function f:

Function : MD

(IV,M)

let M = (m

,.. . ,m

) and h

= IV

for i = 1 to l do

← f(h

i−1

)

return h

Let M

pad

be a padded message according to the

padding functiongivenin (Hirose and Park, 2007) and

φ is a random permutation. Then the MDP

is deﬁned

as follows:

Function : MDP

(IV,M

pad

)

let M

pad

= (m

,...,m

) and h

= IV

l−1

← MD

(IV,(m

,.. . ,m

l−1

))

← f(φ(h

l−1

),m

)

return h

Since the padding function of MDP construction

requires that the last block of the padded message en-

codes the q-bit representation of the length of the orig-

inal message, the second preimage attack proposed

in the following paper need to ﬁnd a second preim-

age with the same length as the target message. Re-

fer to (Hirose and Park, 2007) for the speciﬁcs of the

padding function of MDP construction.

Note that |M| represents the number of blocks of

a message M, m

is the i

b-bit block of M and h

the i

intermediate chaining value in hashing of M. If

there is no special explanation, the notations represent

the same means throughout this paper.

3 OUR SECOND PREIMAGE

ATTACK ON MDP

CONSTRUCTION

Though Hirose et al.(Hirose and Park, 2007) have an-

alyzed the security of MDP construction using the in-

differentiability formulism, up to now no paper has

discuss whether the MDP resists the second preimage

attack or not. In this paper, using the multicollisions

of MD construction, we will present a second preim-

age attack on the MDP construction. Through all this

paper, we assume that the compression function f is

random.

3.1 Building the Multicollisions of MD

The k messages M

,.. . ,M

are called k-

multicollision of MD construction if

) = MD

) = ··· = MD

)

The papers (Kelsey and Schneier, 2005)(Kelsey

and Kohno, 2006)(Joux, 2004) have presented dif-

ferent methods to construct the multicollisions of

MD construction. Speciﬁcally, in (Kelsey and

Schneier, 2005) they introduced a way to construct

(a,b)-expandable messages, which are (b − a + 1)-

multicollison naturally whose lengths can vary in a

range from a to b. Using the method introduced in

(Kelsey and Schneier, 2005), now we describe the al-

gorithm 1 to construct (t,2

+t − 1)-expandable mes-

sages with a starting chaining value IV and lengths

varying from t to 2

+ t − 1, which will be used to

propose our second preimage attack on MDP

Algorithm 1:

Step1. Find two messages B

′

such that

(IV,B

) = MD

(IV,B

′

) = H

where |B

| = 1,|B

′

| = 2

+ 1;

Step2. Use H

as the starting chaining value to con-

struct the next collision pair B

′

satisfying

) = MD

′

) = H

where |B

| = 1,|B

′

| = 2

+ 1;

Step3. For the i

step, we need to start with the chain-

ing value H

i−1

and ﬁnd a collision pair B

′

such that

i−1

) = MD

i−1

′

) = H

where |B

| = 1,|B

′

| = 2

i−1

+ 1;

Step4. Until obtaining t pairs messages (B

′

)(i =

1,2,...,t), we can construct the (t,2

+ t − 1)-

expandable messages by choosing B

orB

′

(i =

1,2,...,t) in every pair.

SECRYPT 2009 - International Conference on Security and Cryptography

246

Remark:

(1) From the above algorithm 1, we know that the

shortest message in the multicollisions is B

k B

··· k B

and the longest message is B

′

k B

′

k ··· k B

′

whose length is

∑

i=1

i−1

+ 1) = 2

+ t − 1

Moreover, by choosing B

or B

′

(i = 1, 2,... ,t) in ev-

ery pair, we can obtain messages of different lengths

varying from t to 2

+ t − 1.

(2) We can use the algorithm described in (Kelsey

and Schneier, 2005) to construct a collision pair B

′

such that

i−1

) = MD

i−1

′

) = H

and |B

| = 1,|B

′

| = 2

i−1

+ 1. The speciﬁcs are as fol-

lows:

Step1. Assume m is one block chosen randomly in

advance. Process 2

i−1

given message blocks:

-H

temp

= H

i−1

;

-For j = 0 to 2

i−1

− 1 do

′

temp

= f(H

temp

,m) and H

temp

= H

′

temp

Step2. Build lists A and B as follows:

-For j = 0 to 2

n/2−1

− 1 do

A[ j] = f(H

i−1

) and B[ j] = f(H

temp

)

where a

and b

are chosen randomly and |a

| =

| = 1;

Step3. Find j

, j

such that A[ j

] = B[ j

] and return

the collision pairs (a

,m k m k ... k m k b

Therefore, the computational complexity of ﬁnd-

ing B

′

such that

i−1

) = MD

i−1

′

) = h

and |B

| = 1,|B

′

| = 2

i−1

+ 1 is about 2

i−1

+ 2

n/2+1

compression function operations. Hence, the compu-

tational complexity of algorithm 1 is about

∑

i=1

i−1

+ 2

n/2+1

) = t × 2

n/2+1

+ 2

≈ t × 2

n/2+1

3.2 Our Second Preimage Attack on

MDP

Hash Function

Let M = (m

,...,m

+k+1

) be the target message

of 2

+ k + 1 blocks. Our attack is to ﬁnd another

message M

′

of 2

+k+1 blocks differentfrom M such

that MDP

′

) = MDP

(M). The speciﬁc algorithm

is described below:

Preprocessing step: Construct (k,2

+ k − 1)-

expandable messages with a starting value IV and an

arbitrary target value H

according to algorithm 1;

Algorithm 2:

Step1. Randomly choose a one-block message B such

that the value of f(H

,B) equals to one of the chaining

values h

,...,h

produced in the hashing of M,

that is, f(H

,B) = h

where k+ 1 ≤ i

≤ 2

+ k;

Step2. Choose a message M

of i

− 1 blocks from

the (k,2

+ k − 1)-expandable messages constructed

in the preprocessing step;

Step3. Form a message

′

= M

k B k m

k ··· k m

+k+1

satisfying MDP

′

) = MDP

(M) (If i

= 2

+ k,

then only the last block of original message is in-

cluded in the second preimage).

3.3 Analysis of the Computational

Complexity of the Above Algorithm

In the above algorithm, since the one-block mes-

sage B is chosen randomly and k + 1 ≤ i

≤ 2

+ k,

the probability of guaranteeing that f (H

,B) = h

. So the computational complexity of step1

is about 2

n−k

. And the computational complexity of

the step2 and step3 can be ignored. Additionally, the

computational complexity of the preprocessing step is

about k× 2

n/2+1

. Hence, the computational complex-

ity of the above algorithm is about k × 2

n/2+1

+ 2

n−k

which is less than 2

4 CONCLUSIONS

In this paper, using the (k,2

+ k − 1)-expandable

messages with a starting chaining value IV, we

present a second preimage attack on hash functions

with MDP construction and analyze the computa-

tional complexity of our second preimage attack

which is k× 2

n/2+1

+ 2

n−k

less than 2

REFERENCES

Xiaoyun W. and Hongbo Y. (2005), How to break MD5 and

other hash functions. In Eurocrypt 2005, LNCS 3494,

pp. 474-490. Berlin: Springer-Verlag, 2005.

Kelsey J.and Schneier B.(2005), Second preimages on n-bit

hash functions for much less than 2

word. In Euro-

crypt 2005, LNCS 3494, pp. 19-35. Berlin: Springer-

Verlag, 2005.

A SECOND PREIMAGE ATTACK ON THE MERKLE-DAMGARD SCHEME WITH A PERMUTATION FOR HASH

FUNCTIONS

247

Kelsey J. and Kohno T.(2006), Herding hash functions and

the Nostradamus attack. In Eurocrypt 2006, LNCS

4004, pp. 183-200. Berlin: Springer-Verlag, 2006.

Gauravaram P. and Kelsey J.(2007), Cryptanalysis of a

Class of Cryptographic Hash Functions. In CT-RSA

2008, http://eprint.iacr.org/2007/277.

Coron J.S., Dodis Y., Malinaud C. and Puniya P.(2005),

Merkle-Damgard Revisited: How to Construct a Hash

Function. InCRYPTO 2005. LNCS 3621, pp. 430-448.

Berlin: Springer-Verlag, 2005.

Bellare M. and Ristenpart T.(2006), Multi-Property-

Preserving Hash Domain Extension and the EMD

Transform. In ASIACRYPT 2006. LNCS, vol. 4284,

pp. 299-314. Berlin: Springer-Verlag, 2006.

Hirose S., Park J.H. and Yun A.(2007), A Simple Variant

of the Merkle-Damgard Scheme with a Permutation.

In ASIACRYPT 2007. LNCS, vol. 4833, pp. 113-129.

Berlin: Springer-Verlag, 2007.

Joux A.(2004), Multicollisions in Iterated Hash Functions.

In CRYPTO 2004, LNCS 3152, pp. 306-316. Berlin:

Springer-Verlag, 2004.

SECRYPT 2009 - International Conference on Security and Cryptography

248