# Potential weaknesses when combining hash functions?

For consistency's sake, M is the message, H1 and H2 are separate hash functions.

I've heard that concatenation or XORing hash outputs together do not provide improved security against preimage and collision attacks. In some cases, they actually reduce the security instead. Therefore, consider the following scenarios:

(1) Scenario A: H1(M)||H2(M)=Z

In this scenario, the hash output of H1 and H2 are concatenated to form the final output Z. Let's say H1 is a weak hash function, and H2 is a strong hash function. If I find a preimage M for H1(M), does it mean that I have found a preimage for H1(M)||H2(M) as well?

(2) Scenario B: H1(M)||H2(M)=Z

In this scenario, H1 and H2 are both 256-bit hash functions truncated to 80-bits output, and are concatenated together to form the 160-bit output Z. Let's say we want to find a preimage for Z, which is an 160-bit string consisted entirely of "1"s. Let's say H1 is weak, and I can instantly find 2t preimages for H1(M), in which these Ms can produce an H1 output of 80 bits of 1. In this case, how much remaining work do I need to find a full preimage M for the H1||H2 concatenation that would hash to an output Z of 160 bits of "1"?

(3) Scenario C: H1(M)+H2(M)=Z, where "+" denotes an XOR operation

In this scenario, H1 and H2 are both 256-bit hash functions truncated to an 80-bit output, and are XORed together to form the 80-bit output Z. Let's say we want to find a preimage for Z, which is an 80-bit string consisted entirely of "0"s. Let's say H1 is weak, and I can instantly find 2t preimages for H1(M), in which these Ms can produce an H1 output of 80 bits of 0. In this case, how much remaining work do I need to find a full preimage M for H1+H2 concatenation that would hash to an output Z of 80 bits of "0"?

• Hints: 1) No Why would be that 2) The problem that they are different hash functions one pre-image is not the same for the other. 3) same here. May 4, 2020 at 11:39