2008 | OriginalPaper | Buchkapitel
Building a Collision-Resistant Compression Function from Non-compressing Primitives
(Extended Abstract)
verfasst von : Thomas Shrimpton, Martijn Stam
Erschienen in: Automata, Languages and Programming
Verlag: Springer Berlin Heidelberg
Aktivieren Sie unsere intelligente Suche, um passende Fachinhalte oder Patente zu finden.
Wählen Sie Textabschnitte aus um mit Künstlicher Intelligenz passenden Patente zu finden. powered by
Markieren Sie Textabschnitte, um KI-gestützt weitere passende Inhalte zu finden. powered by
We consider how to build an efficient compression function from a small number of random, non-compressing primitives. Our main goal is to achieve a level of collision resistance as close as possible to the optimal birthday bound. We present a 2
n
-to-
n
bit compression function based on three independent
n
-to-
n
bit random functions, each called only once. We show that if the three random functions are treated as black boxes then finding collisions requires
Θ
(2
n
/2
/
n
c
) queries for
c
≈ 1. This result remains valid if two of the three random functions are replaced by a fixed-key ideal cipher in Davies-Meyer mode (i.e.,
E
K
(
x
) ⊕
x
for permutation
E
K
). We also give a heuristic, backed by experimental results, suggesting that the security loss is at most four bits for block sizes up to 256 bits. We believe this is the best result to date on the matter of building a collision-resistant compression function from non-compressing functions. It also relates to an open question from Black et al. (Eurocrypt’05), who showed that compression functions that invoke a single non-compressing random function cannot suffice.