8

Context: We usually assume that the hash functions we use in practice are both: collision resistant and pseudorandom. I wonder what's the relation between those properties.

Question: Is a pseudo random function always collision resistant?


Clarification: This questions suggests that hash functions are pseudo-random functions, which is often not the case (e.g., see Length extension attack). The main question whether pseudo-randomness implies collision resistance is still a valid question.

mti
  • 697
  • 3
  • 13

5 Answers5

4

First, a PRF is a keyed function, meanwhile a hash function is usually keyless. So, a hash function cannot be a PRF.

Second, a secure PRF can be swapped with a uniform random function without detection, and the best way to find a collision of a uniform random function is the birthday attack. So, if the PRF has superpolynomially large codomain, then it would be collision-resistant, since the birthday attack would take more than polynomial-time.

AYun
  • 858
  • 7
  • 13
3

No, a PRF isn't always collision resistant.

Take CBC-MAC, which is a PRF assuming prefix-free messages. If you know the key, you can create a different message that produces the same tag, which is a collision.

With hash-based MACs (e.g., HMAC), this isn't the case assuming a collision-resistant hash function is used and not something cryptographically broken like MD5 or SHA-1.

There's a difference between being weakly collision resistant (collision resistant when the key is unknown) and strongly collision resistant (even when the key is known).

And it turns out this difference matters in practice because a lack of collision resistance is what has lead to commitment attacks on popular AEAD schemes. Key/context commitment has now become a desirable property in new schemes, which can be achieved using the duplex construction or similar.

samuel-lucas6
  • 2,211
  • 9
  • 20
1

Avoiding the question really, but collision resistance isn't really a considered property of Pseudo-random functions.

Looking at the definition of a PRF:

F :: {0,1}k x {0,1}n --> {0,1}m

F ( key, x ) = y

the main consideration is how well it emulates the random function [f(x) = y] when given a random key.

Jackoson
  • 133
  • 4
1

Not any PRF is necessarily collision resist. If the PRF is a PRP, than for inputs of length of block-length, the PRP is necessarily collision resist because its on-to function, so it is impossible that two inputs are mapped to the same output. When the PRF is not PRP, depends on its output length, it can be collision resist.

Evgeni Vaknin
  • 1,155
  • 8
  • 20
-2

A PRF is indistinguishable from a random oracle. A random oracle is collision resistant. Hence, a PRF is also collision resistant.


Update: This answer lacks some clarity. The comments showed that the definition of collision resistance in the context of a PRF is not necessarily clear. A PRF appears only random to an observer that doesn't know the key. However, collision resistance typically requires that collisions are also hard to find when the key is known.

mti
  • 697
  • 3
  • 13