Tight time-space lower bounds for finding multiple collision pairs and their applications

Abstract

We consider a collision search problem (CSP), where given a parameter C, the goal is to find C collision pairs in a random function (Formula presented) (where (Formula presented) using S bits of memory. Algorithms for CSP have numerous cryptanalytic applications such as space-efficient attacks on double and triple encryption. The best known algorithm for CSP is parallel collision search (PCS) published by van Oorschot and Wiener, which achieves the time-space tradeoff (Formula presented). In this paper, we prove that any algorithm for CSP satisfies (Formula presented), hence the best known time-space tradeoff is optimal (up to poly-logarithmic factors in N). On the other hand, we give strong evidence that proving similar unconditional time-space tradeoff lower bounds on CSP applications (such as breaking double and triple encryption) may be very difficult, and would imply a breakthrough in complexity theory. Hence, we propose a new restricted model of computation and prove that under this model, the best known time-space tradeoff attack on double encryption is optimal.