49
$\begingroup$

From Wikipedia:

Second pre-image resistance

Given an input $m_1$ it should be difficult to find another input $m_2$ such that $m_1$ ≠ $m_2$ and $\operatorname{hash}(m_1) = \operatorname{hash}(m_2)$. Functions that lack this property are vulnerable to second-preimage attacks.

Collision resistance

It should be difficult to find two different messages $m_1$ and $m_2$ such that $\operatorname{hash}(m_1) = \operatorname{hash}(m_2)$. Such a pair is called a cryptographic hash collision.

Could someone explain the difference between these two please? They very much appear to be identical to me, as in both definitions $m_1 \neq m_2$ and $\operatorname{hash}(m_1) = \operatorname{hash}(m_2)$.

$\endgroup$
1

1 Answer 1

75
$\begingroup$

The difference is in the choice of $m_1$.

  • In the first case (second preimage resistance), the attacker is handed a fixed $m_1$ to which he has to find a different $m_2$ with equal hash. In particular, he can't choose $m_1$.
  • In the second case (collision resistance), the attacker can freely choose both messages $m_1$ and $m_2$, with the only requirement that they are different (and hash to the same value).

(From this, it is also obvious that collision resistance implies second preimage resistance: An attacker can just choose an arbitrary $m_1$ and compute a second preimage $m_2$ to obtain a collision.)

$\endgroup$
1
  • $\begingroup$ Then it sounds like collision-resistant hash functions are not necessary for digital signatures to be secure. Without an already known signature, there'd be no hash to forge a signature against. I must be wrong with that. $\endgroup$
    – Melab
    Commented Jul 26, 2023 at 20:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.