Computational cryptography › Hashes and symmetric ciphers
Hardness assumption

Second-preimage resistance

In plain words

Given a document, you can't find a different document with the same fingerprint.

The idea: Second-preimage resistance protects one specific document: given it, nobody can craft a different one with the same fingerprint. That's weaker than collision resistance, where the attacker gets to choose both inputs, so it's a safer thing to rely on: generic attacks need about 2^n work for an n-bit hash instead of 2^(n/2).

Why it matters: Enough for hash-based signatures.

The details

Given a specific input, it is infeasible to find a different input with the same hash[1].

Enough for hash-based signatures such as SPHINCS+[2]. Breaking preimage resistance also breaks this, which is why it sits below.

Rests on

If any of these breaks, this breaks too.

If it falls

If this breaks, these break with it.

Everything that falls with it (4 boxes)

References

  1. Phillip Rogaway and Thomas Shrimpton. Cryptographic Hash-Function Basics: Definitions, Implications, and Separations for Preimage Resistance, Second-Preimage Resistance, and Collision Resistance. Fast Software Encryption, 2004. doi:10.1007/978-3-540-25937-4_24
  2. Daniel J. Bernstein, Andreas Hülsing, Stefan Kölbl et al. The SPHINCS + Signature Framework. Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security. doi:10.1145/3319535.3363229