Questions tagged [miyaguchi-preneel]

The Miyaguchi-Preneel scheme, based on a one-way compression function, was proposed around 1989 by Preneel, and independently by Miyaguchi.Ohta, and Iwata.

The Miyaguchi-Preneel scheme was proposed around 1989 by Preneel, and independently by Miyaguchi.Ohta, and Iwata.

The Miyaguchi–Preneel single-block-length is a one-way compression function with the mathematical notation: $H_i = E_{g(H_{i-1})}(m_i)\oplus H_{i-1}\oplus m_i$. It feeds each block of the message $m_i$ as the plaintext to be encrypted, and the output ciphertext is then XORed with the same message block $m_i$ and also XORed with the previous hash value $H_{i-1}$ to produce the next hash value $H_i$. The previous hash value $H_{i-1}$ is fed as the key to the block cipher. In the first round when there is no previous hash value it uses a constant pre-specified initial value $H_0$. If the block cipher has different block and key sizes, the hash value $H_{i-1}$ will have the wrong size for use as the key. The cipher might also have other special requirements on the key. Then the hash value is first fed through the function $g(…)$ to be converted/padded to fit as key for the cipher.

5 questions
14
votes
2 answers

Why was Davies–Meyer chosen over Miyaguchi–Preneel most of the time?

The only Miyaguchi–Preneel MD hash I know is Whirlpool. I suppose there are likely others. Why do most MD hashes choose Davies–Meyer? If anything, Davies–Meyer relies on related-key resistance while Miyaguchi–Preneel relies on chosen-plaintext…
8
votes
1 answer

Why are the Davies-Meyer and Miyaguchi-Preneel constructions secure?

The Davies-Meyer compression function $h(H, m) = E_m(H) \oplus H$ is said to be secure. So too is the Miyaguchi-Preneel compression function $h(H, m) = E_m(H) \oplus m \oplus H$. Why are these secure? How do we know that they are secure? (Here…
D.W.
  • 35,877
  • 12
  • 95
  • 183
6
votes
2 answers

Choice of reduction polynomial in Whirlpool's internal cipher

Whirlpool is an interesting little hash function in the Miyaguchi-Preneel family. In my mind, it's most interesting feature is the design of internal cipher W, where the distinction between key and message is dropped, providing a symmetric symmetric…
5
votes
1 answer

Pseudo preimage for a hash made from a cipher

Consider the Miyaguchi–Preneel construction: $H_0 = E(0,m_0) \oplus m_0$ (0 here means a vector filled with zeros) $H_1 = E(H_0,m_1) \oplus H_0 \oplus m_1$ where $E(K,M)$ is a block cipher (for example AES), $m_0, m_1$ are messages. What's the…
qwer
  • 177
  • 5
1
vote
0 answers

Why is the compression function in Miyaguchi-Preneel scheme secure?

I was reading about the Miyaguchi-Preneel scheme and had difficulty in understanding why the compression function, $h(H,m)=E(H, H \oplus M) \oplus M \oplus H$ can be called secure. The only resource I could find about this was Black-Box Analysis of…
Tom Corless
  • 67
  • 1
  • 4