1
$\begingroup$

Talking about hash functions, I know the hierarchy is as follows:

  1. Pre-image resistance
  2. Second pre-image resistance
  3. Collision resistance

Where each property implies the one before it so 2nd pre-image resistance implies pre-image resistance.. But is this also true the other way around?

Can we infer from the absence of second pre-image resistance, that there would also be the absence of pre-image resistance?

$\endgroup$
3
$\begingroup$

No, it is easy to show that (assuming that there are preimage-resistant functions at all) there are functions that the preimage-resistant, but not second-preimage resistant.

If we assume that SHA512 is preimage resistant, one such function is:

$$H(x) = SHA512(Trunc(x))$$

where $Trunc(x)$ just returns $x$ with the last byte removed.

$H$ is not second-preimage resistant; given $H(x)$, we can change the last byte of $x$ to another value that hashes to the same value. However, given a target hash value $z$, we can't find a value $x$ with $z = H(x)$; if we did, then we could find preimages to SHA512.

And, in practice, it doesn't only come up only in artificial hash functions (as above); in real hash functions, we can often come up with a way to 'tweak' the message in such a way so that the intermediate state of the hash function happens to be unchanged after the tweak (which would imply that the hash value is unchanged).

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.