On the Security of Double-Block-Length Hash Functions with Rate 1

The security of double-block-length hash functions with rate 1, which are based on a block cipher with a block length of n bits and a key length of 2n bits, was analyzed by Satoh et al. and Hirose. In this paper, we reconsider the security of this general class of hash functions (named FDBL-II for brevity). The new counter-examples and attacks are presented on FDBL-II, which reveal some flaws in the necessary conditions proposed by Satoh et al. and Hirose. Moreover, our analysis shows that all rate-1 hash functions in FDBL-II fail to be optimally (second) preimage resistant. Finally, the necessary conditions are revised for ensuring that a subclass of hash functions in FDBL-II can be optimally secure against collision attacks.