Collisions and inversions for Damgård's whole hash function

Abstract

Ivan Damgård gave a great theorem about hash functions in

Then, he suggested, among others, to choose for f a knapsack scheme. However, in [1] and [4] it was shown that it is possible to find collisions on f, and even to find a preimage for f with an algebraic algorithm. Nevertheless, it was not shown how to find collision, or a preimage for h. (We call h Damgård's “whole” Hash function). Then, in [3] it was shown how to find a collision on h with the LLL Algorithm.

Here we will show how to find collision, and also how to find a preimage for h with an algebraic algorithm. A quick comparison of the two techniques (LLL and Algebraic) will be given.

For example, in about 2³³ operations and 2²⁴ storage it will be possible to find a collision for h. And with about 2⁴⁸ operations and 2³² storage we will be able to find a preimage for h. (This is better than the previously known algorithm for a preimage given in [5] p. 202 which needs 2⁶⁴ in time and 2³² in memory). Then we will study how to construct from f two new candidate hash functions H1 and H2 by slightly modifying Damgård's scheme in order to make the search of collisions more difficult, and in order to have a theorem showing why it looks “more difficult”.