2

Talking about hash functions, I know the hierarchy is as follows:

  1. Pre-image resistance
  2. Second pre-image resistance
  3. Collision resistance

Where each property implies the one before it so 2nd pre-image resistance implies pre-image resistance.. But is this also true the other way around?

Can we infer from the absence of second pre-image resistance, that there would also be the absence of pre-image resistance?

Silverfox
  • 871
  • 6
  • 11

1 Answers1

4

No, it is easy to show that (assuming that there are preimage-resistant functions at all) there are functions that the preimage-resistant, but not second-preimage resistant.

If we assume that SHA512 is preimage resistant, one such function is:

$$H(x) = SHA512(Trunc(x))$$

where $Trunc(x)$ just returns $x$ with the last byte removed.

$H$ is not second-preimage resistant; given $H(x)$, we can change the last byte of $x$ to another value that hashes to the same value. However, given a target hash value $z$, we can't find a value $x$ with $z = H(x)$; if we did, then we could find preimages to SHA512.

And, in practice, it doesn't only come up only in artificial hash functions (as above); in real hash functions, we can often come up with a way to 'tweak' the message in such a way so that the intermediate state of the hash function happens to be unchanged after the tweak (which would imply that the hash value is unchanged).

poncho
  • 147,019
  • 11
  • 229
  • 360