On Free-Start Collisions and Collisions for TIB3

In this paper, we present free-start collisions for the TIB3 hash functions with a complexity of about 2 compression function evaluations. By using message modification techniques the complexity can be further reduced to 2. Furthermore, we show how to construct collisions for TIB3 slightly faster than brute force search using the fact that we can construct several (different) free-start collisions for the compression function. The complexity to construct collisions is about 2 for TIB3256 and 2 for TIB3-512 with memory requirements of 2 and 2 respectively. The attack shows that compression function attacks have been underestimated in the design of TIB3. Although the practicality of the proposed attacks might be debatable, they nevertheless exhibit non-random properties that are not present in the SHA-2 family.