Reports › hash-31 · Constant-time review

The ZC-DMC Hash Function (hash-31)

hash-31-1: Cross-domain distinguisher between ZC-1536-512 and ZC-1536-768

Original source: CryptHashForum report

The two instances share the same 1536-bit permutation and zero initial state, while moving the rate/capacity feed-forward boundary. Further extension to Tsinghua Hash Lab's analysis: take a common first 704-bit block (zero-extended to 960 bits for the 512 profile), then a zero block. After these two absorptions the states differ only at bits 704–959, by D = P(B1)[704:960]. Putting D in that region of the 512 profile's third block makes both final permutation inputs equal. Feed-forward leaves their first 704 state bits equal, so the first 64-bit squeeze blocks agree. The first-block counter value 13 gives the four-bit suffix needed to make both final blocks valid under the mandatory M || 01 || 10*1 padding.

The official 512- and 768-bit CryptHash libraries return the same first eight digest bytes, 7a07b396b47dfec4, for the constructed messages. A one-bit control differs. This is a cross-profile distinguisher (ideal probability 2^-64), not a same-instance or full-digest collision.

Follow-up analysis: the Iphe Algorithm Group's cross-rate note, posted by 崔灏睿 on 2026-09-23 gives an independent three-block ZC-DMC witness. The ZC-DMC team's response on 2026-09-23 acknowledges the relation and proposes distinct three-bit IV tags; this report concerns the archived zero-IV submission.

Reproducing

Commands below run in a checkout of the ngcc-harness repository with the candidate built (see its README).

From the repository root, run make -C hash-31 exploit. The witness uses only the two official archived hash libraries for its verdict and prints CONFIRMED hash-31-1.