22

I've seen contradictory results. Sometimes hash functions are collision-resistant but not necessarily second-preimage resistant. I've seen this kind of things in papers from Bart Preneel:

How that can be possible ?

We have theorems that say that if a hash function is collision-resistant then it is second preimage resistant as well:

Morrolan
  • 1,147
  • 6
  • 17
Dingo13
  • 2,867
  • 3
  • 27
  • 46
  • 2
    Please provide a link to the claim that there are collision resistant but not second-preimage resistant hashes. – CodesInChaos Jun 28 '14 at 10:27
  • 5
    The only thing I can think of is that we usually expect $2^n$ second pre-image resistance, whereas collision resistance is limited to $2^{n/2}$. So from collision resistance we can only prove $2^{n/2}$ second preimage resistance, not the stronger bound we'd like. – CodesInChaos Jun 28 '14 at 10:29

1 Answers1

26

With the definitions that a function $F$ is

  • collision-resistant when a [computationally bounded] adversary can't [with sizable odds] exhibit any $(a,b)$ with $a\ne b$ and $F(a)=F(b)$;
  • first-preimage-resistant when, given $f$ determined as $F(a)$ for an unknown random $a$, a [computationally bounded] adversary can't [with sizable odds] exhibit any $b$ with $F(b)=f$;
  • second-preimage-resistant when, given a random $a$, a [computationally bounded] adversary can't [with sizable odds] exhibit any $b$ with $a\ne b$ and $F(a)=F(b)$

yes, collision-resistance implies second-preimage resistance. Proof by contraposition: assume the property for second-preimage-resistant does not hold. Repeatedly pick a random $a$, perform the attack that exhibits a $b$ with $a\ne b$ and $F(a)=F(b)$, until it succeeds. By our assumption, that requires a feasible amount of work. Once exhibited, that pair $(a,b)$ proves that the property collision-resistant does not hold.


However, as pointed by CodesinChaos in his comment, the answer is no for definitions of collision-resistance and preimage-resistance that quantify the difficulty of finding a collision or (respectively) preimage, to roughly $2^{n/2}$ or (respectively) $2^n$ evaluations, where $n$ is is the number of bits in the output.

Proof by counterexample: for even $n$, assume a hash function $H:\{0,1\}^*\to\{0,1\}^n$ that behaves as a random function. Now construct $F:\{0,1\}^*\to\{0,1\}^n$ as $$F(x)=\begin{cases}x||x&\text{if }x\text{ has }n/2\text{ bits}\\H(x)&\text{otherwise}\end{cases}$$ $F$ has the collision-resistant property (when $a$ and $b$ are both $n/2$ bits, $a\ne b\implies F(a)\ne F(b)$; when neither $a$ nor $b$ are $n/2$ bits, collision resistance is that of $H$; when a single of $a$ or $b$ is $n/2$ bits, the other must have a hash with two equals halves, and it takes effort about $2^{n/2}$ hashes to exhibit such input). However the following algorithm breaks the second-preimage resistance property for $F$ at cost comparable to $2^{n/2}$ hashes, much less than required: if the random $a$ is not of size $n/2$, compute $H(a)$, and if its two halves are equal (which is expected to occur after $2^{n/2}$ hashes), let $b$ be that bitstring of $n/2$ bits; it holds that $a\ne b$ and $F(a)=F(b)$.


In summary: a function's second-preimage-resistance is always at least as strong as its collision-resistance; but it can be not much stronger, rather than quadratically stronger, which is the theoretical ideal. So depending on definition, collision-resistance implies second-preimage-resistance.. or not! That's true when we keep the same security level (effort and odds of success of adversary) to assess the two properties. That's false when we expect a security level consistent with the property and the function's output size.


Addition following comments: The question links to a paper by Elena Andreeva, Bart Mennink, and Bart Preneel Security Properties of Domain Extenders for Cryptographic Hash Functions. That highly technical paper considers various proposed extension methods to iterate the core building block of a hash function over much larger input than the core block accepts; and if security properties of that core are conserved in the extended construction, to comparable level (work for attack and odds of success).

As any good paper should, that paper gives its specific definitions, and for some established ones refers to its reference [15]: P. Rogaway & T. Shrimpton Cryptographic Hash-Function Basics: Definitions, Implications, and Separations for Preimage Resistance, Second-Preimage Resistance, and Collision Resistance. All these quantitative definitions stay fully consistent with the classical result that for any given level (work for attack and odds of success), collision-resistance implies second-preimage-resistance.

The paper shows that some extension methods demonstrably (mostly) preserve the level of collision-resistance but do not demonstrably (mostly) preserve the level of second-preimage-resistance. That is entirely consistent with the above rule.

For example, starting from a core block assumed collision-resistant to $\mathcal O(2^{n/2})$ effort and second-preimage-resistant to $\mathcal O(2^n)$ effort, some extender might construct a hash that is collision-resistant to $\mathcal O(2^{n/2})$ effort and second-preimage-resistant to $\mathcal O(2^{2\cdot n/3})$ effort. The less-than-perfect extender conserved the level of collision-resistance, but not the level of second-preimage-resistance. Yet, for the hash built using that extender, collision-resistance to some effort level still implies second-preimage-resistance to that effort level.

fgrieu
  • 140,762
  • 12
  • 307
  • 587
  • 1
    A sponge with capacity $n$ is another example. This one is important since NIST considered having SHA-3 with only $2^{n/2}$ preimage resistance. – CodesInChaos Jun 28 '14 at 21:04
  • @CodesInChaos: Following your comment, I've been trying to construct a sponge-based hash with capacity $n$, an argument of collision-resistance with effort about $2^{n/2}$, and an explicit second-preimage attack with effort $2^{n/2}$ (rather than a proof of security to effort $2^{n/2}$); but failed. Am I missing the obvious, or is that worth a separate question? – fgrieu Jun 30 '14 at 10:53
  • 1
    If you have a two block message you can run a meet-in-the-middle attack since the primitive function is invertible. This should break (second) preimage resistance with cost $2^{c/2}$ where $c$ is the capacity. (I didn't look into the memory requirements, they might be unrealistically large) This is the reason why SHA-3 uses $c=2 n$. – CodesInChaos Jun 30 '14 at 11:04
  • Thanks @fgrieu. "So depending on definition, collision-resistance implies second-preimage-resistance, or not." Such a different definition is implicit in this kind of paper ? – Dingo13 Jun 30 '14 at 17:42
  • @Dingo13: No, in this kind of paper dealing with theoretical aspect of security, definitions of security are explicit, or at least given by an explicit reference. In the quoted paper a great number of subtly different definitions of security are given in 2.2, with two pages and a half devoted to that. – fgrieu Jun 30 '14 at 18:23
  • @fgireu These definitions don't clarify this subtility and they speak about standard security notions. Which sentence in these 2/3 pages let us think that collision resistance implies second-preimage if we consider that the bounds are the same ? Maybe the paragraph on "provable security" at the end but this is not clearly explained. – Dingo13 Jun 30 '14 at 18:42
  • @Dingo13: in the paper you quote, discussion about collision-resistance implying second-preimage-resistance (in the classical sense of that) seems to be left to the the source of the definitions, that is reference [15], P. Rogaway & T. Shrimpton Cryptographic Hash-Function Basics: Definitions, Implications, and Separations for Preimage Resistance, Second-Preimage Resistance, and Collision Resistance; see the useful figure 1, and the first of 6 properties in their proposition 6 [Conventional implications]. – fgrieu Jun 30 '14 at 22:24
  • @fgrieu, you certainly speak about the non classical sense ? The paper I cite consider that collisiion resistance does not imply second-preimage resistance, because of the non preservation of the bound. But the paper you reference consider that collision resistance implies second-preimage resistance. There is a problem, not ? – Dingo13 Jul 01 '14 at 07:31
  • @Dingo13: I do not see where the paper you cite considers that "collision-resistance does not imply second-preimage resistance", be it without further qualification; or with its refined notions of $(t,\epsilon);\text{Coll}$-resistance and $(t,\epsilon);\text{Sec}$-resistance when we keep [update: roughly] the same $(t,\epsilon)$ in the two security notions. – fgrieu Jul 01 '14 at 11:16
  • @fgrieu It's not me that say that. I understood that from your responses (CodesInChao and fgrieu). In the paper I cite, the use of certain domain extenders lead sometimes to hash functions which are collision resistant but not second preimage resistant. So, we can deduct that if the second-preimage resistance is up to a bound $2^{n/2}$ then this is "not" considered second-preimage resistant, since we know that collision resistance (bound $2^{n/2}$) implies second-preimage resistance (bound $2^{n/2}$) in the classical sense. – Dingo13 Jul 02 '14 at 13:12
  • What I want to say is that It seems that the non classical sense is employed, according to your explanations. The problem is that the paper from P. Rogaway & T. Shrimpton seems to be about the classical version. So, discussion about collision-resistance implying second-preimage-resistance (in the classical sense of that) does not seem to be left to this source of the definitions. So where are the definitions to consider in the paper from E. Andreeva and B. Preneel ? – Dingo13 Jul 02 '14 at 13:27
  • @Dingo13: Hopefully, the updated answer will address your comments, and clarify why the paper and its definitions are consistent with: collision-resistance implies second-premimage-resistance; and only shows that an extender that CONSERVES the collision-resistance level of the original may not CONSERVE the second-premimage-resistance level of the original. – fgrieu Jul 03 '14 at 06:50
  • Thanks @fgrieu. If I completely understood your last paragraph, I'm not happy with the definitions since these implicit things should be explaned in these papers. This is very curious that these details are absent, we are accustomed to read collision-resistance -> second-preimage resistance. – Dingo13 Jul 03 '14 at 07:53