On Quantifying the Resistance of Concrete Hash Functions to Generic Multicollision Attacks

Bellare and Kohno (2004) introduced the notion of balance to quantify the resistance of a hash function h to a generic collision attack. Motivated by their work, we consider the problem of quantifying the resistance of h to a generic multicollision attack. To this end, we introduce the notion of r -balance μr(h) of h and obtain bounds on the success probability of finding an r-collision in terms of μr(h). These bounds show that for a hash function with m image points, if the number of trials q is Θ(rm^([(r-1)/(r)])μr(h)) , then it is possible to find r-collisions with a significant probability of success. The behavior of random functions and the expected number of trials to obtain an r-collision is studied. These results extend and complete the earlier results obtained by Bellare and Kohno (2004) for collisions (i.e., r=2). Going beyond their work, we provide a new design criteria to provide quantifiable resistance to generic multicollision attacks. Further, we make a detailed probabilistic investigation of the variation of r-balance over the set of all functions and obtain support for the view that most functions have r -balance close to one.