# Questions tagged [merkle-damgaard]

The Merkle–Damgård construction — used in the design of many popular hash algorithms such as MD5, SHA1 and SHA2 — is a method of building collision-resistant cryptographic hash functions from collision-resistant one-way compression functions. The Merkle–Damgård construction is also referred to as the Merkle–Damgård hash function.

76 questions
Filter by
Sorted by
Tagged with
42 views

### Is the MD5 algorithm only useful for bytes, rather than bits?

The MD5 algorithm is designed to accept a message of any length and produce a 512-bit message digest. Because of the way it pads the original message, by adding a 1-bit then a number of 0-bits, the ...
84 views

### How do herding attacks on hash functions work?

I read this paper Herding Hash Functions and the Nostradamus Attack, 2005 of Kelsey and Kohno on herding attacks but I do not understand how it works. Would anyone be able to give me a summary of how ...
69 views

### How does second pre-image attack on Merkle Signature Scheme work?

I understand that a second pre-image attack on the Merkle tree works by creating another Merkle tree using the intermediate nodes as the leaf nodes, and this will lead to the same root hash (public ...
27 views

### Is $f_N$ in this hash function is Matyas-Meyer-Oseas scheme?

I propose a hash function as following: H is an Merkle-Damgard hash function with a compression function $f: \{0,1\}^{3n} \to \{0, 1\}^{2n}$. Output function $f_N: \{0,1\}^{3n} \to \{0, 1\}^n$. M is ...
23 views

### Sorted merkle tree versus rsa accumulator

When compared to sorted merkle tree and rsa accumulator, which one is the best? Rsa accumulator has constant proof and it adds/deletes at constant cost. What is the verification cost for rsa ...
16 views

### Merkle tree verification cost calculation

I am trying to understand how to calculate verification cost of sorted merkle tree in case of exclusion proof. For example 5 revoked certificate are kept in merkle tree. How can i calculate storage ...
113 views

497 views

### Why was Davies–Meyer chosen over Miyaguchi–Preneel most of the time?

The only Miyaguchi–Preneel MD hash I know is Whirlpool. I suppose there are likely others. Why do most MD hashes choose Davies–Meyer? If anything, Davies–Meyer relies on related-key resistance while ...
639 views

477 views

### Can I use M1 straight away and get rid of IV in Merkle–Damgård?

In Merkle–Damgård is there any reason why we use a fixed $IV$ at the beginning? Can we use the first block ($M_1$) right away instead of $IV$ and feed it through the compression function with $M_2$.
139 views

### What happens if I modify the Merkle–Damgård hash method? [duplicate]

Does the Merkle–Damgård hash function still offer Collision Resistance (CR) when the following changes are made? Each case is independent from the other. Here is what I want to modify: Say I want to ...
123 views

### Is there any hash function for which a preimage of a fixed element is always known?

I'm wondering if there is any collision-resistant hash function $h^s(\cdot)$ satisfying that there is a fixed value $c$ such that, for each $s$, a value $x_s$ satisfying $h^s(x_s) = c$ is known. This ...