Questions tagged [miyaguchi-preneel]

The Miyaguchi-Preneel scheme, based on a one-way compression function, was proposed around 1989 by Preneel, and independently by Miyaguchi.Ohta, and Iwata.

Filter by
Sorted by
Tagged with
14 votes
2 answers
1k views

Why was Davies–Meyer chosen over Miyaguchi–Preneel most of the time?

The only Miyaguchi–Preneel MD hash I know is Whirlpool. I suppose there are likely others. Why do most MD hashes choose Davies–Meyer? If anything, Davies–Meyer relies on related-key resistance while ...
MikeDav77741's user avatar
1 vote
0 answers
426 views

Why is the compression function in Miyaguchi-Preneel scheme secure? [duplicate]

I was reading about the Miyaguchi-Preneel scheme and had difficulty in understanding why the compression function, $h(H,m)=E(H, H \oplus M) \oplus M \oplus H$ can be called secure. The only resource I ...
Tom Corless's user avatar
6 votes
2 answers
603 views

Choice of reduction polynomial in Whirlpool's internal cipher

Whirlpool is an interesting little hash function in the Miyaguchi-Preneel family. In my mind, it's most interesting feature is the design of internal cipher W, where the distinction between key and ...
Cryptographeur's user avatar
8 votes
1 answer
4k views

Why are the Davies-Meyer and Miyaguchi-Preneel constructions secure?

The Davies-Meyer compression function $h(H, m) = E_m(H) \oplus H$ is said to be secure. So too is the Miyaguchi-Preneel compression function $h(H, m) = E_m(H) \oplus m \oplus H$. Why are these ...
D.W.'s user avatar
  • 36.4k
5 votes
1 answer
321 views

Pseudo preimage for a hash made from a cipher

Consider the Miyaguchi–Preneel construction: $H_0 = E(0,m_0) \oplus m_0$ (0 here means a vector filled with zeros) $H_1 = E(H_0,m_1) \oplus H_0 \oplus m_1$ where $E(K,M)$ is a block cipher (for ...
qwer's user avatar
  • 177