In this paper, we introduce new compression function design principles supporting variable output lengths (multiples of size
n). They are based on a function or block cipher with an
n-bit output size. In the case of the compression function with a (
t+1)
n-bit output size, in the random oracle and ideal cipher models, their maximum advantages from the perspective of collision resistance are
O(
t2q/2
tn+
q2/2(
t+1)
n). In the case of
t=1, the advantage is near-optimal. In the case of
t>1, the advantage is optimal.
抄録全体を表示