Reports › hash-19

MoFang Hash Function (hash-19)

hash-19-1: Round-key cancellation gives deterministic full-round collisions

Original source: CryptHashForum report

MoFang uses the two 576-bit halves of each message block as cipher keys. Both key schedules move words 5 and 7 identically, never apply the S-box to them, and rotate them only by odd amounts. Applying the same two-periodic XOR difference to the corresponding words in both halves therefore cancels from every combined round key, for every chaining value and all 16 rounds.

As a concrete collision, let M be 120 zero bytes and let M' set bytes 40--47 and 112--119 to ff. MoFang-512 maps both to ebbc07cddba0f381917c62cf0954fd63eb3e162065f61b14baef1a8d09982e5fbbd9f6ce5aac1e7d36d979126e11358c0635f4a8d2bda29e037ed733e1a9aca4; the same pair collides in every other submitted instance. Because the cancellation is independent of the base key, it also supplies a same-length second preimage for every message of at least 960 bits. Independent differences in words 5 and 7 give 16 equivalent choices per complete message block and multicollisions across blocks.

Further analysis: Yufei Yuan et al., Structural Analysis of Seven Hash Functions Submitted to the NGCC, Section 3 (2026-09-23), proves the cancellation for the fixed-output and XOF variants.

Reproducing

Commands below run in a checkout of the ngcc-harness repository with the candidate built (see its README).

The local witness checks the published pair and a nonzero-base second preimage against all six submitted libraries:

make -C hash-19 reproduce