Cryptanalysis of the Yi-Lam Hash

This paper analyzes the security of a hash mode recently proposed by Yi and Lam. Given a block cipher with m-bit block size and 2m-bit key, they build a hash function with 2m-bit outputs that can hash messages as fast as the underlying block cipher can encrypt. This construction was conjectured to have ideal security, i.e., to resist all collision attacks faster than brute force. We disprove this conjecture by presenting a collision attack that is substantially faster than brute force and which could even be considered practical for typical security parameters.