I was reading about the Miyaguchi-Preneel scheme and had difficulty in understanding why the compression function, $h(H,m)=E(H, H \oplus M) \oplus M \oplus H$ can be called secure. The only resource I could find about this was Black-Box Analysis of the Block-Cipher-Based Hash-Function Constructions from PGV.

Again, I am having trouble with the explanation provided there. So, if someone could please clear my doubt, that would be great, thanks!

  • $\begingroup$ Did you read this answer? It points to that paper so perhaps you did? $\endgroup$ – otus Mar 3 '16 at 7:45
  • 1
    $\begingroup$ Thanks, I did. I looked at this first, before posting my question. The one who answered there has only referred to that paper and explained what an ideal cipher is. I already know the latter, it is the explanation in the paper/the answer to my question, that I want help with. $\endgroup$ – Tom Corless Mar 3 '16 at 19:23
  • $\begingroup$ The formula you have given seems to be incorrect to me. $\endgroup$ – aventurin Mar 3 '16 at 21:51