Linear-XOR and additive checksums don't protect Damgård-Merkle hashes from generic attacks

Abstract

We consider the security of Damgård-Merkle variants which compute linear-XOR or additive checksums over message blocks, intermediate hash values, or both, and process these checksums in computing the final hash value. We show that these Damgård-Merkle variants gain almost no security against generic attacks such as the long-message second preimage attacks of [10,21] and the herding attack of [9]. © 2008 Springer-Verlag Berlin Heidelberg.