0
$\begingroup$

For consistency's sake, M is the message, H1 and H2 are separate hash functions.

I've heard that concatenation or XORing hash outputs together do not provide improved security against preimage and collision attacks. In some cases, they actually reduce the security instead. Therefore, consider the following scenarios:

(1) Scenario A: H1(M)||H2(M)=Z

In this scenario, the hash output of H1 and H2 are concatenated to form the final output Z. Let's say H1 is a weak hash function, and H2 is a strong hash function. If I find a preimage M for H1(M), does it mean that I have found a preimage for H1(M)||H2(M) as well?

(2) Scenario B: H1(M)||H2(M)=Z

In this scenario, H1 and H2 are both 256-bit hash functions truncated to 80-bits output, and are concatenated together to form the 160-bit output Z. Let's say we want to find a preimage for Z, which is an 160-bit string consisted entirely of "1"s. Let's say H1 is weak, and I can instantly find 2t preimages for H1(M), in which these Ms can produce an H1 output of 80 bits of 1. In this case, how much remaining work do I need to find a full preimage M for the H1||H2 concatenation that would hash to an output Z of 160 bits of "1"?

(3) Scenario C: H1(M)+H2(M)=Z, where "+" denotes an XOR operation

In this scenario, H1 and H2 are both 256-bit hash functions truncated to an 80-bit output, and are XORed together to form the 80-bit output Z. Let's say we want to find a preimage for Z, which is an 80-bit string consisted entirely of "0"s. Let's say H1 is weak, and I can instantly find 2t preimages for H1(M), in which these Ms can produce an H1 output of 80 bits of 0. In this case, how much remaining work do I need to find a full preimage M for H1+H2 concatenation that would hash to an output Z of 80 bits of "0"?

$\endgroup$
  • $\begingroup$ Hints: 1) No Why would be that 2) The problem that they are different hash functions one pre-image is not the same for the other. 3) same here. $\endgroup$ – kelalaka May 4 at 11:39
0
$\begingroup$

For generic weakness no. Consider two weak hash functions H(x) = 1 This isn't preimage resistant but obviously concatenating a 1 to a hash function does not make it easier to find a preimage to it.

And consider H(x)=x A very different kind of weakness and concatenate the message or parts of it would be super helpful in finding a preimage for the other function.

| improve this answer | |
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.