This is from this video https://www.coursera.org/learn/crypto/lecture/XZt5V/constructing-compression-functions
At 2:44, Dan Boneh explains why the XOR is required.
This is his explanation
m - message to be hashed
H - output of previous hash (chaining input)
h - hash function
E - Encryption function
D - Decryption function
h(H, m) = E(m, H)
(instead of h(H, m) = E(m, H) XOR H )
You can choose a random H, m & m' & construct a
H' = D(m', E(m, H))
which will give you a collision for m & m'
He says that the Decryption will cancel out the Encryption which will result in the collision.
- Can someone explain how?
- Why is he allowed to choose H'? Shouldn't you be allowed only to choose m' for an attack? Why do you get to choose H' also?
IMP: I have read other explanations for why the XOR is needed & I am convinced also. However, here I am trying to understand Dan Boneh's explanation.