Collision Resistance of the JH Hash Function

In this paper, we analyze collision resistance of the JH hash function in the ideal primitive model. The JH hash function is one of the five SHA-3 candidates accepted for the final round of evaluation. The JH hash function uses a mode of operation based on a permutation, while its security has been elusive even in the random permutation model. One can find a collision for the JH compression function only with two backward queries to the basing primitive. However, the security is significantly enhanced in iteration. For c≤ n/2, we prove that the JH hash function using an ideal -bit permutation and producing -bit outputs by truncation is collision resistant up to O(2^c/2)queries. This bound implies the optimal collision resistance of the JH hash function in the random permutation model.