Two-permutation-based hashing with binary mixing

We consider the generic design of compression functions based on two n-bit permutations and XOR-based mixing functions. It is known that any such function mapping n + α to α bits, with 1 ≤ α ≤ n, can achieve at most min{2, 2n/2−α/4} collision security. Using techniques similar to Mennink and Preneel (CRYPTO 2012), we show that there is only one equivalence class of these functions achieving optimal collision security, and additionally min{2, 2} preimage security. The equivalence class compares well with existing functions based on two or three permutations, and is well-suited for wide-pipe hashing.