We have a collision resistant hash function (based MD construction) H with 2n bits hash value size. Call chop(H) is a chopping n-bits from H's hash output. How can I prove a chop(H) is collision resistant with n-bit?

  • $\begingroup$ Welcome to Cryptography. The chop actually is called truncation. Hint: Consider that it is not collision-resistant. What can you say about H? Also, the truncated version may not be collision-resistant due to the truncated bit size. $\endgroup$ – kelalaka May 15 '20 at 17:03
  • $\begingroup$ What hypothesis do you have on the compression function iterated in the MD construction? And in your definition of collision-resistance, does the cost scale with the width of the hash? $\endgroup$ – fgrieu May 15 '20 at 17:27

How to prove a chop(H) is collision resistant with n-bit?

Is this statement true? Is it true that all collision resistant hash functions remain collision resistant after chopping?

As a hint, you might want to consider this question.

  • $\begingroup$ Yes, that's my question? $\endgroup$ – user80059 May 15 '20 at 17:24
  • $\begingroup$ Well, what's the answer? Could you define a collision resistant hash function that becomes non-collision resistant after chopping? $\endgroup$ – poncho May 15 '20 at 17:42
  • $\begingroup$ OP is likely confusing it with length extension attacks. Hash functions that are vulnerable to length extension attacks are not in their truncated versions, OP probably mixed them up because these two are probably the most talked about attacks for hash functions. $\endgroup$ – Manish Adhikari Jun 11 at 5:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.