Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.
Sign up to join this community
Talking about hash functions, I know the hierarchy is as follows:
Where each property implies the one before it so 2nd pre-image resistance implies pre-image resistance.. But is this also true the other way around?
Can we infer from the absence of second pre-image resistance, that there would also be the absence of pre-image resistance?
No, it is easy to show that (assuming that there are preimage-resistant functions at all) there are functions that the preimage-resistant, but not second-preimage resistant.
If we assume that SHA512 is preimage resistant, one such function is:
$$H(x) = SHA512(Trunc(x))$$
where $Trunc(x)$ just returns $x$ with the last byte removed.
$H$ is not second-preimage resistant; given $H(x)$, we can change the last byte of $x$ to another value that hashes to the same value. However, given a target hash value $z$, we can't find a value $x$ with $z = H(x)$; if we did, then we could find preimages to SHA512.
And, in practice, it doesn't only come up only in artificial hash functions (as above); in real hash functions, we can often come up with a way to 'tweak' the message in such a way so that the intermediate state of the hash function happens to be unchanged after the tweak (which would imply that the hash value is unchanged).
