Producing Collisions for Panama, Instantaneously

We present a practical attack on the Panama hash function that generates a collision in 2 evaluations of the state updating function. Our attack improves that of Rijmen and coworkers that had a complexity 2, too high to produce a collision in practice. This improvement comes mainly from the use of techniques to transfer conditions on the state to message words instead of trying many message pairs and using the ones for which the conditions are satisfied. Our attack works for any arbitrary prefix message, followed by a pair of suffix messages with a given difference. We give an example of a collision and make the collisiongenerating program available. Our attack does not affect the Panama stream cipher, that is still unbroken to the best of our knowledge.