# Why Merkle Tree doesn't suffer Birthday attack?

I am trying to understand why Merkle Tree doesn't suffer the birthday attack?

Can you help me?

• Birthday attack against what? Collision resistance? All hashes suffer from that one, including merkle-trees, that's why we need 256 bit hashes for 128 bits of collision resistance. – CodesInChaos Dec 6 '15 at 14:35
• What I know in general (I am not saying is correct) is that Merkle Tree is Collision resistant and since the birthday attack is a way to break that property I thought that is not possible attack the Merkle Tree. Now the my doubt is if Merkle Tree is collision resistant. – 4nf3rt Dec 6 '15 at 15:24

• @MaartenBodewes is of course correct. The birthday attack runs in time $2^{n/2}$ where $n$ is the output length. It is thus an exponential-time attack. An attack is only considered to break the primitive if it runs in polynomial time. Of course, concretely, we need to make sure that $n$ is large enough to prevent a practical attack. No hash function should have less than $n=256$ today. – Yehuda Lindell Dec 7 '15 at 16:27