3
$\begingroup$

I understand that hash functions used for hashing a document or some data before signing it, needs to be collision resistant and 2nd pre-image resistance. Otherwise an adversary could "look" for two random documents with the same hash or for a second document, having the same hash as a given document, and just replace the "original document" with the "fake document", because then the signatures of the two documents are also the same.

However, I see no reason, why a hash function for signing documents needs to be preimage resistant, or is it indeed a superfluous property?

$\endgroup$
5
  • 1
    $\begingroup$ 2nd-preimage resistance implies preimage resistance. And your title doesn't match your question! $\endgroup$
    – kelalaka
    Aug 19 '20 at 12:29
  • $\begingroup$ The title and body of the question did not match. Check that I fixed it correctly. $\endgroup$
    – Maeher
    Aug 19 '20 at 15:26
  • $\begingroup$ @Maeher: I suspect he meant the other way around; that he was asking about collision resistance, rather the preimage resistance $\endgroup$
    – poncho
    Aug 19 '20 at 19:51
  • 1
    $\begingroup$ I read it more like: you get 1st preimage for free (although I don't know if that was understood) but is the property of any use within dig sig? $\endgroup$
    – Maarten Bodewes
    Aug 19 '20 at 20:36
  • 1
    $\begingroup$ My fault, you're right. I want to know if preimage resistance is of any use when using the hash function for digital signatures or is it superfluous (theoreticallly)? (Neglecting the fact that 2nd preimage resistance implies preimage resistance) $\endgroup$
    – XDAF
    Aug 20 '20 at 9:29
2
$\begingroup$

A hash function which isn't preimage resistent is also not collision resistance. If I hash a large random message and apply the preimage algorithm I'm extremely unlikely to get the same message I started with, thus finding a collision.

Collision resistance is critical for a hash used in a signature. As you can create forged signatures. Even though you need a bit more in order to forge meaningful messages, such as exploiting internal state collision to make extensions collide and utilize formats like pdf or postscript.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.