Security › hash-34 · Constant-time review · Performance: x86_1 · arm_1

WChain Hash Function (hash-34)

hash-34-1: A four-block reset prefix gives second preimages below the required levels

Original source: Chakraborty's WChain analysis Follow-up source: Chakraborty's draft announcement and pinned draft

WChain uses CF(V,B)=P_B(V)⊕V, two-step feedback H_i=CF(H_{i−1},M_i)⊕H_{i−2}, an XOR checksum of padded blocks, and zero initial states (specification §3 and §5.1, physical pp. 6–8, 18–20; reference wchain_c.c:297–330,372–437). Suppose full blocks X,Y satisfy P_X(0)=P_Y^{-1}(0)=A. Then CF(0,X)=CF(A,Y)=A; absorbing X‖Y‖Y‖X visits states A,A,0,0 and adds zero to the checksum. Consequently, for every message M, Hash(X‖Y‖Y‖X‖M)=Hash(M) after ordinary padding and finalization.

A meet-in-the-middle search matches P_X(0) with P_Y^{-1}(0) in roughly 2^(b/2) evaluations and comparable memory for a b-bit state (b=576 or 1152). The reporter's larger round-equivalent estimates, about 2^292 and 2^580, remain far below the NGCC-required 2^512 and 2^1024 second-preimage levels. The state-reset identity follows exactly from the submitted mode. Its full-size cost assumes birthday-like behavior of the submitted message-keyed permutations; neither a full-size pair nor a full-size second preimage has been computed, hence Probable.

The later draft reports full-size compression-identity checks and reduced-width runs of WChain's round function through 45 state bits (V1) and 36 bits (V2), with search costs near 2^(b/2). Its public code demonstrates only a generic-permutation toy model. These results support, but do not establish at full size, the birthday-like cost estimate; the status remains Probable.

Reproducing

Commands below run in a checkout of the ngcc-harness repository with the candidate built (see its README).

python3 hash-34/reproduce_reset_prefix.py

The certificate checks the frozen reference source's feedback, checksum and finalization paths, then finds a matching pair and verifies the identity in a reduced-width permutation model. It also compiles the submitted full-width compression and checks the conditional four-block identity in 256 trials at each level, with reordered-block controls. These full-width trials start from constructed nonzero states; they do not find a zero-start reset pair or execute the full-size search.

hash-34-2: Short-message checksum cancellation defeats the stated length-extension argument

Original source: Zhang's WChain analysis

For a message m shorter than one block, let p be its single padded block. The first two feedback terms vanish, so Hash(m)=Trunc(CF(CF(0,p),p)). For m'=p‖m, padding gives p‖p and the checksum is zero. Thus, if H=CF(CF(0,p),p) is the full final state, Hash(m')=Trunc(CF(H,0)). The digest reveals all but 64 bits of H in V1 or 128 bits in V2 (specification §3 and §5.1.1, physical pp. 6–8, 18–19; reference wchain_c.c:326–330,371–437,445–479). Enumerating those hidden bits therefore gives a candidate set that contains the second digest, contrary to §5.1.1's statement that the attacker would additionally need a pre-finalization state and checksum relation.

This is a restricted short-message relation, not a demonstrated arbitrary-message length-extension forgery. Without the second hash response or a verification oracle, enumeration alone does not identify which candidate is correct. WChain makes no indifferentiability claim, and this finding establishes no violation of the call's collision or preimage targets.

Reproducing

Commands below run in a checkout of the ngcc-harness repository with the candidate built (see its README).

python3 hash-34/reproduce_two_query_relation.py

The witness builds the submitted reference compression and hash functions in a temporary directory. At both levels it checks the relation using the full internal state, verifies that the published digest is its prefix, and checks changed-message and changed-hidden-word controls. It does not perform the 2^64 or 2^128 enumeration.