# vary length hash collision on deterministic block cipher

I am trying to learn attack on hash collision. I guess for this scheme, it might be possible to use messages with different lengths to find a pair of same ciphertexts. An attempt is to use the same first block, and let M1 = M[1] and M2 = M[1]M[2]. Then, it might be possible to find a collision because the first one outputs C[1] and the second one outputs the C[2], but I am a little confused about how to analyze M[2] so that they form a collision.

• Is $K$ public knowledge, or do you only have Oracle access to $H_k$ (for some unknown $k$)? Apr 4, 2022 at 12:22
• K is known to the adversary, so u can actually calculate Hk without using an oracle but by hand. Apr 4, 2022 at 21:16

• You know the value C[1]; how do you find a fixed point, that is, a value M[2] that maps C[1] to itself (so C[1] = C[2])
• Further hint: it's easier to work backwards; start at the target value of C[2], and figure out how to select M[2] so that B[2] is something appropriate
• @Turingtest: no, I don't believe that is correct; what would M[2] need to be to make sure that B[2] = C[2]? Apr 5, 2022 at 7:39