I was hoping to implement a software that allows testing a user-defined hash function for cryptographic properties (Meant to pique interest in cryptographic hash function for a school showcase), as well as compare them with well-known hash function to identify their hash functions strong points & weak points. However the property collision-resistance got me into a bit of a pickle.
The first obvious thought that occurred to me was the Birthday Paradox Attack, where given that we only with to find an instance of a hash collision (henceprob of hash collision should assumed to be 0.5 or above) thus if the hash function finds a collision on 2^(n/2) operations consistently.
The second option that I considered was to count the length of the hash value & determine the size of the pool for all possible hash values. From there on we prepare a plaintext list of that size to check if the hash values are distributed evenly across the hash value space.
The problem with the two proposed solution I given was that given that the hash value length is significantly large (256 bits or more) this might prove to be an hassle given the large amount of brute force needed to thoroughly check for collisions. Also I was hoping for a more refined way to identify their hash functions flaws.
I am currently looking at length extension attack, the way it functions sounds like a type of differential cryptanalysis attack, I was hoping that I can use this to derive a collision using the padding exploit. (By understanding how they pad. maybe I can use the same type of trick to result in a collision, am still unsure of how exactly it works so I might be completely wrong here)
Other than the methods mentioned above, is there any other ways that I can accomplish this?