COMPSCI 3IS3 - Assignment 2

1. (a) (20 marks) Let h1 : {0, 1}∗ → {0, 1}n and h2 : {0, 1}∗ → {0, 1}n be hash functions
with output length of n bits. Construct a hash function h : {0, 1}∗ → {0, 1}2n by
concatenating the outputs of h1 and h2 , that is, h(x) = h1 (x)∥h2 (x) where ∥ is string
concatenation. Suppose h1 is collision resistant but h2 is not. Can we say that h is
collision resistant? Explain/Prove your claim.
(b) (35 marks) Let m and n be positive integers such that m > n. Let A be an n × m
matrix over the binary ring Z2 . That means A has n rows and m columns and the
entries of A are from {0, 1}. Assume that A is full rank, i.e., the rows are linearly
independent. Define a hash function h : {0, 1}m → {0, 1}n by

h(x) = Ax.

Here, Ax is the matrix-vector product, the input binary string x is considered as a

binary vector of length m. The output of the hash is a binary vector of length n.
Note that all operations are done mod 2. Is h preimage resistant? Is it collision
resistant? Explain.

2. (40 marks) Recall the following construction of a hash function from a block cipher e:
The block cipher accepts a key K and a plaintext M and outputs a ciphertext C, i.e.,
e(K, M ) = C. To build a hash function h from e, we divide the input message M into
the blocks M0 , M1 , . . . , Mt for some t ≥ 1. We also set an initial value K0 once and for
all. Then we compute
Ki = e(Ki−1 , Mi ) ⊕ Mi
for i = 1, . . . , t. The hash value of the message M is then h(M ) = Kt . Suppose that
Trudy knows how to break the cipher e efficiently. That means given any ciphertext C
and message M , he can efficiently compute a key K such that e(K, M ) = C. Can Trudy
launch a preimage or collisison attack on h? Explain.

3. (5 marks) Suppose you are given a hash function h : {0, 1}∗ → {0, 1}100 , and a machine
M that can compute 230 hashes a minute. Using M , how long does it take to find a
collision, with probability 1/2, using the birthday attack, on h?