Re: truncated hashes and MACs

Bill Frantz (frantz@netcom.com)
Wed, 1 Jul 1998 22:47:35 -0800

• Next message: Matt Blaze: "more cryptanalysis of Skipjack variants by Biham et al"
• Previous message: Bruce Schneier: "Re: blowfish's keylen"
• In reply to: bram: "Re: blowfish's keylen"

At 10:48 AM -0800 7/1/98, bram wrote:
>On Wed, 1 Jul 1998, Lewis McCarthy wrote:
>
>> bram writes regarding RFC 2104:
>> >
>> > > These properties, and actually stronger ones, are commonly assumed for
>> > > hash functions of the kind used with HMAC.
>> >
>> > Notice the word 'assume'. Cryptographers aren't normally in the business
>> > of assuming.
>>
>> I'm not sure what point you were making here.
>
>If it said 'only use hashes which were designed to have these properties'
>that would make a lot more sense. It's justified from design criteria
>about everything except truncation.
>
>Now if someone were to say 'we assume it is computationally intractable to
>find two bitstrings each of which starts with the hash of the other', I'd
>say that's completely justified. There are sort of implied properties of
>hashes which are hard to formulate, but truncation properties aren't one
>of them.

As far as I can tell, the whole idea of hashcash is based on the CPU cost
of finding collisions with truncated hashes.

-------------------------------------------------------------------------
Bill Frantz | If hate must be my prison | Periwinkle -- Consulting
(408)356-8506 | lock, then love must be | 16345 Englewood Ave.
frantz@netcom.com | the key. - Phil Ochs | Los Gatos, CA 95032, USA

• Next message: Matt Blaze: "more cryptanalysis of Skipjack variants by Biham et al"
• Previous message: Bruce Schneier: "Re: blowfish's keylen"
• In reply to: bram: "Re: blowfish's keylen"