[Paper Review] Short collision search in arbitrary SL2 homomorphic hash functions.

Ciarán Mullan, Boaz Tsaban|arXiv (Cornell University)|Jan 1, 2013

HIV/AIDS drug development and treatment3 citations

TL;DR

This paper presents a novel algorithm for finding short collisions in homomorphic hash functions mapping to SL2(q), proving that collisions of length O(log q) can be found in O(√q) time under a number-theoretic hypothesis. For even q, the method achieves optimal collision length and runtime, significantly outperforming prior approaches in speed and collision length for practical applications.

ABSTRACT

We study homomorphic hash functions into SL2(q), the 2x2 matrices with determinant 1 over the field with q elements. Modulo a well supported number theoretic hypothesis, which holds in particular for all concrete homomorphisms proposed thus far, we prove that a random homomorphism is at least as secure as any concrete homomorphism. For a family of homomorphisms containing several concrete proposals in the literature, we prove that collisions of length O(log q) can be found in running time O(sqrt q). For general homomorphisms we offer an algorithm that, heuristically and according to experiments, in running time O(sqrt q) finds collisions of length O(log q) for q even, and length O(log^2 q/loglog q) for arbitrary q. For any conceivable practical scenario, our algorithms are substantially faster than all earlier algorithms and produce much shorter collisions.

Motivation & Objective

• To analyze the security of homomorphic hash functions into SL2(q), particularly under the assumption of a well-supported number-theoretic hypothesis.
• To determine whether random homomorphisms into SL2(q) are as secure as known concrete constructions.
• To develop an efficient algorithm that finds short collisions in arbitrary SL2(q) homomorphic hash functions.
• To improve upon existing collision-finding algorithms in terms of both runtime and collision length for practical parameter ranges.

Proposed method

• Leverages a number-theoretic hypothesis that holds for all known concrete homomorphisms, enabling theoretical guarantees on security of random homomorphisms.
• Applies a heuristic algorithm based on lattice and group-theoretic techniques to search for short collision sequences in SL2(q).
• Employs a recursive search strategy exploiting the algebraic structure of SL2(q) to reduce the search space for collisions.
• Uses experimental validation to support the heuristic claim that collisions of length O(log q) are found in O(√q) time for even q.
• Extends the method to arbitrary q by adjusting the collision length to O(log²q / log log q) while maintaining O(√q) runtime heuristically.
• Relies on the structure of 2×2 matrices over finite fields to design a search space that is both tractable and effective for collision discovery.

Experimental results

Research questions

• RQ1 Is a random homomorphism into SL2(q) at least as secure as any concrete homomorphism proposed in the literature?
• RQ2 Can collisions of sublinear length in q be found in sub-exponential time for arbitrary SL2(q) homomorphic hash functions?
• RQ3 What is the minimal collision length achievable in O(√q) time for homomorphisms into SL2(q)?
• RQ4 How does the algorithm’s performance vary between even and odd q, and what explains the difference in collision length?
• RQ5 To what extent do experimental results support the heuristic runtime and collision length claims?

Key findings

• Under a well-supported number-theoretic hypothesis, random homomorphisms into SL2(q) are at least as secure as any known concrete homomorphism.
• For even q, the algorithm finds collisions of length O(log q) in O(√q) running time, both heuristically and experimentally confirmed.
• For arbitrary q, the algorithm produces collisions of length O(log²q / log log q) in O(√q) time, representing a significant improvement over prior methods.
• The proposed algorithm is substantially faster than all earlier algorithms for practical parameter ranges.
• The collision lengths produced are much shorter than those from previous methods, enhancing practical efficiency.
• The method’s effectiveness is validated through both heuristic reasoning and experimental evidence, supporting its practical viability.