Second Preimage Attacks on Dithered Hash Functions

The goal of this paper is to analyze the security of dithered variants of the Merkle-Damgård mode of operation that use a third input to indicate the position of a block in the message to be hashed. These modes of operation for hash functions have been proposed to avoid some structural weaknesses of the Merkle-Damgard paradigm, e.g. that second preimages can be constructed in much less than 2 work, as pointed out by Kelsey and Schneier [17]. Among the modes of operation that use such a third input are Rivest's dithered hashing [26] and Biham and Dunkelman's Haifa proposal [24]. We propose several new second preimage attacks on the Merkle-Damgård mode of operation, which can also attack Rivest's dithered hash with almost the same complexity. When applied to Shoup's UOWHF [27], these attacks can be shown to be optimal since their complexity matches Shoup's security bound. However, our attacks cannot be applied to HAIFA.