Construction of secure and fast hash functions using nonbinary error-correcting codes

Attacking the Knudsen-Preneel Compression Functions

“…The preprocessing function C pre of H is defined by a generator matrix G of the code [5,3,3] 4 . Using the G proposed in [10] and defining ϕ by (that is also the one given in [10] Therefore, given W ∈ {0, 1} 6n , H n computes the digest Z ∈ {0, 1} 5n as follows:…”

“…(We use the journal version [10] as our frame of reference). Although their work was ostensibly targeted at blockcipher-based designs, the main technical thread of their work develops a transform that extends the range of an 'ideal' compression function (blockcipher-based, or not) in a manner that delivers some target level of security.…”

“…To lowerbound the security of their construction, Knudsen and Preneel also present two attacks, one for finding preimages [10,Proposition 3] and one for finding collisions [10,Proposition 4]. We summarize these here, using our formalism.…”

“…Because it is less clear from the theorem what the actual cardinalities will end up being (and consequently which step will be dominating), Table 3 summarizes the relevant quantities for the four non-MDS compression functions KP([r, k, d] 4 ) suggested by Knudsen and Preneel [10]. Only for the [9,5,4] 4 code the second stage dominates the overall runtime.…”

“…In three papers [8,9,10], Knudsen and Preneel adopted a different approach, namely to let the output size and (relatedly) the number of blockcipher calls vary as needed in order to guarantee a particular security target. Specifically, given r independent ideal compression functions f 1 , .…”