Higher Order Universal One-Way Hash Functions

Abstract

Abstract. Universal One-Way Hash Functions (UOWHFs) are families of cryptographic hash functions for which first a target input is chosen and subsequently a key which selects a member from the family. Their main security property is that it should be hard to find a second input that collides with the target input. This paper generalizes the concept of UOWHFs to UOWHFs of order r. We demonstrate that it is possible to build UOWHFs with much shorter keys than existing constructions from fixed-size UOWHFs of order r. UOWHFs of order r can be used both in the linear (r + 1)-round Merkle-Damgård construction and in a tree construction.

Higher Order Universal One-Way Hash Functions from the Subset Sum Assumption

“…Concretely, we show that the function's security as a kth order UOWHF deteriorates by (at most) about k bits (relative to the UOWHF case k = 0). Combined with the result of [7], we conclude that one can apply the MD extension to the subset sum compression function with 'extension factor' k + 1, while losing (at most) about k bits of UOWHF security relative to the UOWHF security of the compression function (which is almost equivalent to the subset sum problem). We believe our result is of theoretical interest; in particular, as far as we are aware, our result is the first example of a natural UOWHF which is also a provably secure higher order UOWHF under the same well-known cryptographic assumption (while this assumption does not seem sufficient to prove its collision-resistance).…”

“…Hong, Preneel and Song [7] strengthened the definition of UOWHFs (while still being weaker than the CRHF requirement) by allowing the attacker to query an oracle for the hash function k times before commiting to the first input. A function that is secure even under this stronger attack is called a kth order UOWHF.…”

“…In this section we discuss the application of our result to constructing UOWHFs used to hash long messages using a subset-sum compression function, in conjunction with the results of [7].…”

“…However, Hong, Preneel and Lee [7] have shown that if F SS (n, m, p) is a (t, ) kth order UOWHF for some k > 0 and L ≤ k + 1, then the MD family F SS ( , m) is approximately a (t, L · ) UOWHF. Combined with our result (Theorem 2), we conclude that for k = O(log m), the MD family F SS ( , m) is a UOWHF for L ≤ k + 1, assuming only the hardness of SubSum(n, m, p).…”

“…A possible way to use the MD extender for building UOWHF functions was proposed at Asiacrypt 2004 by Hong, Preneel and Lee [7]. They defined a stronger security property for compression functions called higher order UOWHF security.…”