Preimage Attack on Hashing with Polynomials proposed at ICISC'06

In this paper, we suggest a preimage attack on Hashing with Polynomials [2]. The algorithm has n-bit hash output and n-bit intermediate state. (for example, n = 163). The algorithm is very simple and light so that it can be implement in low memory environment. Our attack is based on the meet-in-the-middle attack. We show that we can find a preimage with the time complexity 2 + 2 ∗ (n+1/33) and the memory 2 even though the recursive formula H uses any f whose each term’s degree in terms of x is 2 for a non-negative integer a. We recommend that hash functions such as Hashing with Polynomials should have the intermediate state size at least two times bigger than the output size.