Finding Collisions on a Public Road, or Do Secure Hash Functions Need Secret Coins?