In some views, the standard security properties for a ‘cryptographic hash function’ $H$ are:
- Collision resistance: It is hard to find two messages $x \ne y$ such that $H(x) = H(y)$. Some authors call this ‘strong collision resistance’, but this terminology is not widespread.
- Preimage resistance: Given a hash $h$, it is hard to find a message $x$ such that $H(x) = h$, i.e. such that $x$ is a preimage under $H$ of $h$.
- Second-preimage resistance: Given a message $x$, it is hard to find a second message $y \ne x$ such that $H(x) = H(y)$, i.e. that $x$ is a second preimage under $H$ of $H(y)$ distinct from $y$. Some authors call this ‘weak collision resistance’, but this terminology is not widespread.
MD5 is an example of a hash function without (strong) collision resistance: the strings
share the common MD5 hash cee9a457e790cf20d4bdaa6d69f01e41. But MD5 is conjectured to have second-preimage resistance, i.e. weak collision resistance, because nobody has found a technique to find second preimages that costs less than generic brute force attacks which work the same on any function.
Collision resistance is in general a stronger property than second-preimage resistance—hence the alternative names ‘strong collision resistance’ and ‘weak collision resistance’—because if I have a method of computing second preimages, then I can trivially compute collisions, but not vice versa.
In authentication systems like digital signature schemes, the impact of a second-preimage attack is qualitatively worse than the impact of a collision attack. Suppose Alice signs messages using a signature scheme where a signature $s$ depends on a message $m$ only through $H(m)$. (This includes naive (or maliciously designed) digital signature schemes like RSASSA-PSS, but not sensible digital signature schemes like ordinary Ed25519.)
- Suppose I know a collision attack on $H$. I can use this to find a pair of messages $m \ne m'$, and ask Alice to sign $m$, yielding a signature $s$. Then I can furnish $s$ as a forged signature on the message $m'$, a message which Alice never signed. This requires interaction with Alice.
- Suppose I know a second-preimage attack on $H$. If I ever get my hands on a signature $s$ on a message $m$ from Alice, I can find another message $m' \ne m$, and furnish $s$ as a forged signature on the message $m'$, a message which Alice never signed. This can happen even retroactively without interaction with Alice.
However, this qualitative difference didn't stop researchers from demonstrating HTTPS CA certificate forgery using MD5 collisions in practice. So don't rely too heavily on it!
Of course, there are many other things called hash functions in cryptography—it is a very broad term, and many applications require properties not listed here like pseudorandomness, target collision resistance, or low collision probabilities—and in fact none of the three usual properties at the top even has a formal definition.