A Collision Attack on a Double-Block-Length Compression Function Instantiated with 8-/9-Round AES-256

f0(h0∥h1,M) = Eh1∥M(h0) ⊕ h0 , f1(h0∥h1,M) = Eh1∥M(h0 ⊕ c) ⊕ h0 ⊕ c , where ∥ represents concatenation, E is AES-256 and c is a 16-byte nonzero constant. The proposed attack is a free-start collision attack using the rebound attack proposed by Mendel et al. The success of the proposed attack largely depends on the configuration of the constant c: the number of its non-zero bytes and their positions. For the instantiation with AES256 reduced from 14 rounds to 8 rounds, it is effective if the constant c has at most four non-zero bytes at some specific positions, and the time complexity is 264 or 296. For the instantiation with AES-256 reduced to 9 rounds, it is effective if the constant c has four non-zero bytes at some specific positions, and the time complexity is 2120. The space complexity is negligible in both cases. key words: double-block-length compression function, free-start collision attack, rebound attack, AES-256