Higher Order Universal One-Way Hash Functions from the Subset Sum Assumption

Abstract

Abstract. Universal One-Way Hash Functions (UOWHFs) may be used in place of collision-resistant functions in many public-key cryptographic applications. At Asiacrypt 2004, Hong, Preneel and Lee introduced the stronger security notion of higher order UOWHFs to allow construction of long-input UOWHFs using the Merkle-Damgård domain extender. However, they did not provide any provably secure constructions for higher order UOWHFs.We show that the subset sum hash function is a kth order Universal One-Way Hash Function (hashing n bits to m < n bits) under the Subset Sum assumption for k = O(log m). Therefore we strengthen a previous result of Impagliazzo and Naor, who showed that the subset sum hash function is a UOWHF under the Subset Sum assumption. We believe our result is of theoretical interest; as far as we are aware, it is the first example of a natural and computationally efficient UOWHF which is also a provably secure higher order UOWHF under the same well-known cryptographic assumption, whereas this assumption does not seem sufficient to prove its collision-resistance. A consequence of our result is that one can apply the Merkle-Damgård extender to the subset sum compression function with 'extension factor' k + 1, while losing (at most) about k bits of UOWHF security relative to the UOWHF security of the compression function. The method also leads to a saving of up to m log(k + 1) bits in key length relative to the Shoup XOR-Mask domain extender applied to the subset sum compression function.

PLCrypto: A Symmetric Cryptographic Library for Programmable Logic Controllers

“…We denote such a UOWHF by H sss , which takes as input a message m ∈ {0, 1} lm and outputs a hash value t ∈ {0, 1} l h . Moreover, Steinfeld et al [SPW06] pointed out that higher-order UOWHF can also be constructed from subsetsum assumption, so it is feasible to build a UOWHF function with variable input-length l m ≥ l n using F sss (x, A) as a compression function. UOWHF has many cryptographic applications, e.g., it is widely used for hashing long messages before signing with a digital signature scheme.…”

“…So the minimum number of sub-chains is 256, i.e., the number of signing keys of OTS. Before signing the tail nodes, we compress them using UOWHF H sss as a message domain extender [SPW06]. Also, we need to run the whole initialization in one scan cycle to avoid calculating MAC for too many tags.…”