Security › hash-13 · Constant-time review · Performance: x86_1 · arm_1

JuziHash (hash-13)

hash-13-1: Long messages reduce JuziHash-1024 second-preimage security below 1024 bits

The NGCC hash call requires second-preimage security of at least h bits for an h-bit digest (Evaluation Criteria §1(2)) and message lengths of at least 2^64 − 1 bits, which JuziHash-1024 does not meet for long messages.

JuziHash-1024 injects each 1024-bit block into the rate and feeds the previous 1024-bit capacity forward after the permutation; the digest is the capacity (§5.2; CryptHash_AlgorithmInstance.c:227-289). A long target offers many intermediate states. An expandable message can be built from collisions in the 1024-bit capacity projection. If two branch states have equal capacity, one corrective message block cancels their rate difference before the permutation, after which the complete states merge. These components cost about k·2^513; linking to one of 2^k target capacities costs about 2^(1024−k). The specification concedes the resulting long-message effect: a target of 2^k blocks reduces second-preimage cost by about k bits, and valid inputs of up to 2^54 blocks give "a worst-case long-message scale around 2^970 for JuziHash-1024" (§5.5, physical PDF pages 19–20). Its Table 2 nevertheless lists 2^1024 (page 24), to be read only for "ordinary-message or fixed-length" inputs.

Reproducing

Commands below run in a checkout of the ngcc-harness repository with the candidate built (see its README).

Compare the call requirement with §5.5 (physical PDF pages 19–20) and Table 2 (page 24) of the specification.