Compression Function Design Principles Supporting Variable Output Lengths from a Single Small Function

Abstract

In this paper, we introduce new compression function design principles supporting variable output lengths (multiples of size n). They are based on a function or block cipher with an n-bit output size. In the case of the compression function with a (t+1)n-bit output size, in the random oracle and ideal cipher models, their maximum advantages from the perspective of collision resistance are O(t²q/2^tn+q²/2(t+1)n). In the case of t=1, the advantage is near-optimal. In the case of t>1, the advantage is optimal.