The only Miyaguchi–Preneel MD hash I know is Whirlpool. I suppose there are likely others.


Why do most MD hashes choose Davies–Meyer?


If anything, Davies–Meyer relies on related-key resistance while Miyaguchi–Preneel relies on chosen-plaintext resistance. The former ought to be far more difficult to achieve.

So I'm curious about the rationale.


After some further research all I could find was the fact that Davies-Meyer is more efficient because it allows you to stretch the message block based on how the key schedule of the underlying block cipher works. Whereas Miyaguchi–Preneel forces you have

length(key) = length(message block) = length(output)

and deviating from that while possible (with padding) complicates security. So I guess the question is whether that the only reason? Performance? Flexibility? SHA2 may not be able to have variants (eg: 256, 512) as easily with Miyaguchi-Preneel.

  • 1
    $\begingroup$ I don't know the answer, but I do know that Whirlpool uses a AES-like cipher, making the choice of Davies-Meyer with related-key resistance probably a no-go. That's just trying to answer the reverse question though :) $\endgroup$ – Maarten Bodewes Nov 17 '18 at 13:52
  • $\begingroup$ Note that (in theory) Davies-Meyer allows you to compute the key schedules only depending on the data input and can thus (in theory) be done in parallel with encryption eg the previous block, this could be nice for hardware implementations. $\endgroup$ – SEJPM Nov 18 '18 at 7:01
  • $\begingroup$ @MaartenBodewes I don't think that's true, because the Whirlpool compression function is more resistant against related-key attacks (it reuses the round function for the key-schedule). $\endgroup$ – Aleph Nov 18 '18 at 19:06
  • $\begingroup$ @Aleph Yeah, that would probably rule out related key attacks. Hmm. The problem with these why questions is that the reason for choosing one or the other is usually not documented. $\endgroup$ – Maarten Bodewes Nov 18 '18 at 21:34

Some ideas (not a definitive answer):

  1. Davies–Meyer is one of the two simplest among the 12 secure methods by which a block cipher and XOR can be turned into an iterative hash with one encryption per block, per the analysis of Bart Preneel, René Govaerts, Joos Vandewalle's Hash functions based on block ciphers: a synthetic approach, in proceedings of Crypto 1993.

    table 3
    Note: in the above table, the block cipher $E$ uses its first argument as key.
  2. Davies–Meyer (method 5) is the only of the 12 that works with a block cipher having a key of width different of its block without needing an adapter (the g in the first drawing of the question).
  3. When the key is wider than the block, that characteristic 2 makes Davies–Meyer use less encryptions for large messages, and that can translate into a speed advantage.
  4. MD4, which was influential on MD5, then SHA, SHA-1 and SHA-2, essentially used Davies–Meyer (except for replacement of XOR with modular addition on a word).
  • 2
    $\begingroup$ Davies–Meyer is not method 1 in that table. It's 5. $\endgroup$ – MikeDav77741 Nov 20 '18 at 19:15
  • $\begingroup$ @MikeDav77741 Indeed, method 1 is Matyas-Meyer-Oseas. $\endgroup$ – Aleph Nov 20 '18 at 19:54

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.