I propose a hash function as following:

H is an Merkle-Damgard hash function with a compression function $f: \{0,1\}^{3n} \to \{0, 1\}^{2n}$. Output function $f_N: \{0,1\}^{3n} \to \{0, 1\}^n$. M is input message and M* is padded message as follow rule: message M divided into n-bit message blocks $m_i$, $1 ≤ i ≤ t$ and t = $\lceil|M|\rceil/n - 1$, $m_t+1$ is last block (remaining part) of M is padded with bit ‘1’ and ‘0’-bits to get full n-bit block and $m_t+2$ represent message’s bit length in binary of M. $M^* = Pad(M) = m_1 m_2...m_{t+1} m_{t+2}, m_i \in {0, 1}^n$, with $1 \leq i \leq t+2$;

Hash computing process is handed according to follow procedure:

\begin{multline} \shoveleft h_0 = IV_1\\ \shoveleft g_0 = IV_2\\ \shoveleft C_{T_i} = 0 \end{multline}

\begin{multline} \shoveleft \textbf{for } i = 1 \textbf{ to } t+1 \textbf{ do }\\ \shoveleft \quad\quad (h_i, g_i) = f(h_{i-1} \oplus C{{T_i}}, g_{i-1}, m_i)\\ \shoveleft C_{T_i} = C{T_{i-1}} + 512\\ \shoveleft (h_{t+1}, g_{t+1}) = f(h_t \oplus C_{T_{t+1}}, g_t, m_{t+1}) \\ \shoveleft H(x) = left_s f_N(h_{t+1}, g_{t+1}, m_{t+2})) \end{multline}

$H(x)$ is the hash result.

left is get $s$ bits on left of $f_N$

My $f_N$ is:

$$f_N: h = E(h_{t+1}\mathbin\|g_{t+1},m_i ) \oplus m_i$$ $E(K,m)$ is a block cipher with $2n$-bit keylength, block size is $n$-bit.

My questions:

  • Is $f_N$ in this hash function Matyas-Meyer-Oseas scheme?
  • And may I use Theorem 6 and 15 in Stam's result in "Stam, Martijn. "Blockcipher-based hashing revisited. for this compress function?
  • $\begingroup$ The $f$ is Matyas-Meyer-Oseas not $f_N$. $f_N$ is MD. $\endgroup$
    – kelalaka
    Jul 2, 2020 at 16:55
  • $\begingroup$ kelalaka - You means if I write $(h_i, g_i) = E(h_{i-1}||g_{i-1}, m_i)$, it will be MMO (PGV1) scheme? $\endgroup$
    – user80059
    Jul 3, 2020 at 3:50


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.