Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Suppose a message $m$ is divided into blocks of length $160$ bits: $m > = M_1 || M_2 || ... || M_l$ And define $h(m) = M_1 \oplus M_2 \oplus ... \oplus M_l$

Which of the three desirable properties of a good cryptographic hash function does h satisfy? Show that it does not satisfy the other two.

Three desirable properties of a cryptographic hash function

I feel like if there is only one, like the question states, it has to be the first one, preimage resistance. However, given a hash $h = 000....0$ I can find a bunch of $m$'s that could give that particular hash. Maybe since there are lots of solutions you can't pin point the specific $m$ that gave that value?

What do you think?

share|improve this question
up vote 9 down vote accepted

I believe that this is a poorly written question: such an $h$ obviously doesn't have either preimage resistance, second preimage resistance or collision resistance.

The inability to rederive the specific value of $m$ based on its hash is not an interesting property; it's pretty much true of any function which generates an output shorter than its input.

I don't know where you're getting these questions from; based on this question, I'd suggest you look elsewhere.

share|improve this answer
Old Exams, thanks for the confirmation of my worst fears! – Bobby S Dec 16 '11 at 17:43
  1. ⊕ is a relatively simple operation, so $h(x)$ can be calculated quickly.

  2. preimage resistant: No. Given $h(x)$, we can construct $M_1||M_2||...||M_l$ in an arbitrary manner. Since we know h(m), we have a 160 bit string of 0s and 1s. For each 0 in $h(M)$, we can assign an even number of 1s (or all 0s) to that position in the l blocks. For each 1 in $h(m)$, we can assign any odd number of 1s to that position in the l blocks.

  3. Strongly collision-free: No. We are only looking for $M_1 \nleqq M_2$ but $h(M_1) = h(M_2)$. We do not have to base this on a given h(m). So, we can arbitrarily construct $M_1||M_2||...||M_l$ for some number of blocks $l$. We could change an even number of 1s from a given position to 0, from 0 to 1, etc. and this changes the message but not the hash value.

share|improve this answer
Stackexchange uses markdown not latex for formatting posts. It has limited latex support for formulas enclosed in $ (mathjax). – CodesInChaos Jul 9 at 20:40

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.