Producing collisions for PANAMA, instantaneously

Abstract

We present a practical attack on the PANAMA hash function that generates a collision in 26 evaluations of the state updating function. Our attack improves that of Rijmen and coworkers that had a complexity 2 82, too high to produce a collision in practice. This improvement comes mainly from the use of techniques to transfer conditions on the state to message words instead of trying many message pairs and using the ones for which the conditions are satisfied. Our attack works for any arbitrary prefix message, followed by a pair of suffix messages with a given difference. We give an example of a collision and make the collision-generating program available. Our attack does not affect the PANAMA stream cipher, that is still unbroken to the best of our knowledge. © International Association for Cryptologic Research 2007.