Better price-performance ratios for generalized birthday attacks

Fix i and k with k = 2i−1. This paper presents a generalizedbirthday attack that uses a machine of size 2 for time 2 to find (m1, . . . , mk) such that f1(m1) + · · ·+ fk(mk) mod 2 = 0. The exponents 2/(2i + 1) and 1/(2i + 1) are smaller than the exponents for Wagner’s original generalized-birthday attack. The improved attack also allows a linear tradeoff between time and success probability, and an ith-power tradeoff between machine size and success probability.