Two-permutation-based hashing with binary mixing

Abstract

We consider the generic design of compression functions based on two n-bit permutations and XOR-based mixing functions. It is known that any such function mapping n+α to α bits, with 1≤α≤n, can achieve at most min{2α/2,2n/2-α/4} collision security. Using techniques similar to Mennink and Preneel [CRYPTO 2012, Lecture Notes in Comput. Sci. 7417, Springer, Heidelberg (2012), 330–347], we show that there is only one equivalence class of these functions achieving optimal collision security, and additionally min{2α,2n/2} preimage security. The equivalence class compares well with existing functions based on two or three permutations, and is well-suited for wide-pipe hashing.