Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

What is significance of recovering the chaining value of a compression function, when the message and its output are known? in other words, if a compression function $CF$ takes a chaining value $h_{in}$ and a message $m$ as inputs and outputs $h_{out}$.

$h_{out}=CF(h_{in}, m)$

Is it a bad property if given $m$ and $h_{out}$ to recover $h_{in}$?

share|improve this question
up vote 4 down vote accepted

This should be considered as a weakness of the compression function, which is not a preimage resistant anymore. Sometimes, but not always, this may imply an attack on a hash function or a larger construction using this compression function.

For instance, consider the prefix MAC scheme, which is constructed out of a hash function $H$ as follows: $$ MAC_K(M) = H(K||M). $$ The prefix scheme is secure for some hash functions, for example the SHA-3 (Keccak) hash function.

However, if the compression function used by $H$ is not preimage resistant, then an adversary given $MAC_K(M)$ may recover the chaining value $$ CV=H(K), $$ and construct a valid MAC for any other $M'$ even though he does not know $K$.

share|improve this answer
Thanks for the answer, I see its relavence in this situation, but is recovering the chaining value and not the message implies that the compression function is not preimage resistant? or like partially invertable. Does this property have a name? – Ricoz Jan 18 '14 at 22:43
Compression function squeezes its long input (possibly consisting of several shorter parameters) into a short output. If part of input can be recovered, it is not preimage-resistant, no matter where this part is located. – Dmitry Khovratovich Jan 19 '14 at 8:28
Thanks for your help. – Ricoz Jan 19 '14 at 21:35

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.