Finding Collisions on a Public Road, or Do Secure Hash Functions Need Secret Coins?

Many cryptographic primitives begin with parameter generation, which picks a primitive from a family. Such generation can use public coins (e.g., in the discrete-logarithm-based case) or secret coins (e.g., in the factoring-based case). We study the relationship between public-coin and secret-coin collision-resistant hash function families (CRHFs). Specifically, we demonstrate that: • there is a lack of attention to the distinction between secret-coin and public-coin definitions in the literature, which has led to some problems in the case of CRHFs; • in some cases, public-coin CRHFs can be built out of secret-coin CRHFs; • the distinction between the two notions is meaningful, because in general secret-coin CRHFs are unlikely to imply public-coin CRHFs. The last statement above is our main result, which states that there is no black-box reduction from public-coin CRHFs to secret-coin CRHFs. Our proof for this result, while employing oracle separations, uses a novel approach, ...

• Type: Conference
• Year: 2004
• Where: CRYPTO
• Authors: Chun-Yuan Hsiao, Leonid Reyzin
• Keywords: CRYPTO 2004, Many Cryptographic Primitives, Public-coin Crhfs, Secret-coin Crhfs