I have studied linear cryptanalysis for block ciphers, but i did not understand how it works on hash functions. Can you give me an explanation of this attack on hash functions?
The use of linear cryptanalysis for unkeyed hash functions seems to data back to the article (available here) below
Handschuh H, Knudsen LR, and Robshaw MJ, Analysis of SHA-1 in encryption mode, published in the Cryptographers' Track-RSA Conference, Naccache, D. (Ed.), LNCS 2020, Springer-Verlag, Berlin, pp.70-83, 2001
The authors state:
SHA was never defined to be used for encryption. However, the compression function can be used for encryption. Each of the 80 steps of SHA-1 (divided into four rounds, each of 20 steps) are invertible in the five A, B, C, D, and E variables used for compression. Therefore, if one inserts a secret key in the message and a plaintext as the initial value, one gets an invertible function from the compression function by simply skipping the last forward addition with the input. This is the encryption mode of SHA considered in this report. The resulting block cipher is named SHACAL and has been submitted to NESSIE by Naccache and the first author.