# Is CRC32 birthday attack independent of input?

I have a configuration table which stores all device of a system and the corresponding serial numbers :

|------------------------|---------------------------|--------------------------|
|            #           |   Device type (1 byte)    |  Serial number (4 bytes) |
|------------------------|---------------------------|--------------------------|
|            1           |           0x11            |        0x????????        |
|------------------------|---------------------------|--------------------------|
|            2           |           0x00            |        0x00000000        |
|------------------------|---------------------------|--------------------------|
|            3           |           0x33            |        0x????????        |
|------------------------|---------------------------|--------------------------|
|            4           |           0x22            |        0x????????        |
|------------------------|---------------------------|--------------------------|
|            5           |           0x44            |        0x????????        |
|------------------------|---------------------------|--------------------------|
|            6           |           0x00            |        0x00000000        |
|------------------------|---------------------------|--------------------------|
|           ...          |            ...            |            ...           |
|------------------------|---------------------------|--------------------------|
|           30           |           0x11            |        0x????????        |
|------------------------|---------------------------|--------------------------|
|           31           |           0x00            |        0x00000000        |
|------------------------|---------------------------|--------------------------|


In the configuration table there are only four different device types possible. This means when I replace the device, then only the serial number changes. Some of the rows can be empty and will maybe be latter filled with a device type and serial number due to the inseration of a new device to the system. The storing row of the single devices in not predictable.

I want to calculate the CRC32 over the configuration table (only device type and serial number), which means $n = 2^{1240} + 1$ and $k << n$ for a CRC32 ($b = 32$ bits and $k = 2^b$). The purpose of the checksum is to detect a change of the configuration (e.g. change of serial number by constant device type). In the case of the serial number only single bits can change. My concerns are the collision probabillity of the CRC32 is to high that I don't detect a change in the configuration.

After some google searching I found the birthday problem:

which form my understanding would tell me that the CRC32 is sufficient for my use case.

Despite that I still have some questions:

1. Can I apply the birthday problem/attack to this input values by using the CRC32 (CRC is unequal to Hash)?

2. Is the birthday problem/attack independent of the fixed length input?

3. What is the best value for the empty rows to increase collision resistance of the checksum?

• If you are looking for collision resistance, then I would not use CRC32. Finding collisions on it is easy. – mikeazo Jan 8 '18 at 19:58
• To expand on what Mike asked, are you wondering whether someone would be able to craft a modified configuration that would not change the CRC? Or, are you wondering whether CRC would likely detect a change (assuming that the change wasn't deliberately selected to have the same CRC)? – poncho Jan 8 '18 at 20:21
• @mikeazo No, I don't looking for collision resistance in the sense of integrity (like HMAC-SHA1). – ge45mue Jan 8 '18 at 22:04
• @poncho Yes it's more the CRC would likely detect a change. Meaning somebody ("attacker") from outside exchanges the device (same device type) and different serial number, but I still want to be able to detect this change. And I want to avoid from a probabilty sense that this two configuration creating the same CRC. – ge45mue Jan 8 '18 at 22:07