Iterated Halving has been suggested as a replacement to the Merkle-Damgard construction following attacks on the MDx family of hash functions. The core of the scheme is an iterated block cipher that provides keying and input material for future rounds. The CRUSH hash function provides a specific instantiation of the block cipher for Iterated Halving. In this paper, we identify structural problems with the scheme, and show that by using a bijective function, such as the block cipher used in CRUSH or the AES, we can trivially identify collisions and second preimages on many equal-length messages of length ten blocks or more. The cost is ten decryptions of the block cipher, this being less than the generation of a single digest. We show that even if Iterated Halving is repaired, the construction has practical issues that means it is not suitable for general deployment. We conclude this paper with the somewhat obvious statement that CRUSH, and more generally Iterated Halving, should not be used.
[1]
Information Security and Privacy
,
1996,
Lecture Notes in Computer Science.
[2]
Xiaoyun Wang,et al.
How to Break MD5 and Other Hash Functions
,
2005,
EUROCRYPT.
[3]
Vincent Rijmen,et al.
The Design of Rijndael: AES - The Advanced Encryption Standard
,
2002
.
[4]
William Millan,et al.
CRUSH: A New Cryptographic Hash Function using Iterated Halving Technique
,
2004,
Cryptographic Algorithms and their Uses.
[5]
Hui Chen,et al.
Cryptanalysis of the Hash Functions MD4 and RIPEMD
,
2005,
EUROCRYPT.
[6]
Xiaoyun Wang,et al.
Finding Collisions in the Full SHA-1
,
2005,
CRYPTO.
[7]
William Millan,et al.
Constructing Secure Hash Functions by Enhancing Merkle-Damgård Construction
,
2006,
ACISP.
[8]
Ivan Damgård,et al.
A Design Principle for Hash Functions
,
1989,
CRYPTO.
[9]
Vincent Rijmen,et al.
The Design of Rijndael
,
2002,
Information Security and Cryptography.