3
$\begingroup$

I understand that hash functions used for hashing a document or some data before signing it, needs to be collision resistant and 2nd pre-image resistance. Otherwise an adversary could "look" for two random documents with the same hash or for a second document, having the same hash as a given document, and just replace the "original document" with the "fake document", because then the signatures of the two documents are also the same.

However, I see no reason, why a hash function for signing documents needs to be preimage resistant, or is it indeed a superfluous property?

Improve this question
$\endgroup$
5
  • 1
    $\begingroup$ 2nd-preimage resistance implies preimage resistance. And your title doesn't match your question! $\endgroup$
    – kelalaka
    Aug 19, 2020 at 12:29
  • $\begingroup$ The title and body of the question did not match. Check that I fixed it correctly. $\endgroup$
    – Maeher
    Aug 19, 2020 at 15:26
  • $\begingroup$ @Maeher: I suspect he meant the other way around; that he was asking about collision resistance, rather the preimage resistance $\endgroup$
    – poncho
    Aug 19, 2020 at 19:51
  • 1
    $\begingroup$ I read it more like: you get 1st preimage for free (although I don't know if that was understood) but is the property of any use within dig sig? $\endgroup$
    – Maarten Bodewes ♦
    Aug 19, 2020 at 20:36
  • 1
    $\begingroup$ My fault, you're right. I want to know if preimage resistance is of any use when using the hash function for digital signatures or is it superfluous (theoreticallly)? (Neglecting the fact that 2nd preimage resistance implies preimage resistance) $\endgroup$
    – XDAF
    Aug 20, 2020 at 9:29

1 Answer 1

Reset to default
2
$\begingroup$

A hash function which isn't preimage resistent is also not collision resistance. If I hash a large random message and apply the preimage algorithm I'm extremely unlikely to get the same message I started with, thus finding a collision.

Collision resistance is critical for a hash used in a signature. As you can create forged signatures. Even though you need a bit more in order to forge meaningful messages, such as exploiting internal state collision to make extensions collide and utilize formats like pdf or postscript.

Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.