On Time-Space Tradeoffs for Bounded-Length Collisions in Merkle-Damgård Hashing

Ashrujit Ghoshal*, Ilan Komargodski

*Corresponding author for this work

Research output: Chapter in Book/Report/Conference proceedingConference contributionpeer-review

2 Scopus citations


We study the power of preprocessing adversaries in finding bounded-length collisions in the widely used Merkle-Damgård (MD) hashing in the random oracle model. Specifically, we consider adversaries with arbitrary S-bit advice about the random oracle and can make at most T queries to it. Our goal is to characterize the advantage of such adversaries in finding a B-block collision in an MD hash function constructed using the random oracle with range size N as the compression function (given a random salt). The answer to this question is completely understood for very large values of B (essentially Ω(T) ) as well as for B= 1, 2. For B≈ T, Coretti et al. (EUROCRYPT ’18) gave matching upper and lower bounds of Θ~ (ST2/ N). Akshima et al. (CRYPTO ’20) observed that the attack of Coretti et al. could be adapted to work for any value of B> 1, giving an attack with advantage Ω~ (STB/ N+ T2/ N). Unfortunately, they could only prove that this attack is optimal for B= 2. Their proof involves a compression argument with exhaustive case analysis and, as they claim, a naive attempt to generalize their bound to larger values of B (even for B= 3 ) would lead to an explosion in the number of cases needed to be analyzed, making it unmanageable. With the lack of a more general upper bound, they formulated the STB conjecture, stating that the best-possible advantage is O~ (STB/ N+ T2/ N) for any B> 1. In this work, we confirm the STB conjecture in many new parameter settings. For instance, in one result, we show that the conjecture holds for all constant values of B. Further, using combinatorial properties of graphs, we are able to confirm the conjecture even for super constant values of B, as long as some restriction is made on S. For instance, we confirm the conjecture for all B⩽ T1 / 4 as long as S⩽ T1 / 8. Technically, we develop structural characterizations for bounded-length collisions in MD hashing that allow us to give a compression argument in which the number of cases needed to be handled does not explode.

Original languageAmerican English
Title of host publicationAdvances in Cryptology – CRYPTO 2022 - 42nd Annual International Cryptology Conference, CRYPTO 2022, Proceedings
EditorsYevgeniy Dodis, Thomas Shrimpton
PublisherSpringer Science and Business Media Deutschland GmbH
Number of pages31
ISBN (Print)9783031159817
StatePublished - 2022
Event42nd Annual International Cryptology Conference, CRYPTO 2022 - Santa Barbara, United States
Duration: 15 Aug 202218 Aug 2022

Publication series

NameLecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
Volume13509 LNCS
ISSN (Print)0302-9743
ISSN (Electronic)1611-3349


Conference42nd Annual International Cryptology Conference, CRYPTO 2022
Country/TerritoryUnited States
CitySanta Barbara

Bibliographical note

Publisher Copyright:
© 2022, International Association for Cryptologic Research.


Dive into the research topics of 'On Time-Space Tradeoffs for Bounded-Length Collisions in Merkle-Damgård Hashing'. Together they form a unique fingerprint.

Cite this