Abstract: We point out that the seemingly strong pseudorandom oracle preserving (PRO-Pr) property of hash function domain-extension transforms defined and implemented by Coron, Dodis, Malinaud, Puniya can actually weaken our guarantees on the hash function, in particular producing a hash function that fails to be even collision-resistant (CR) even though the compression function to which the transform is applied is CR. Not only is this true in general, but we show that all the transforms presented by Coron et al have this weakness. We suggest that the appropriate goal of a domain extension transform for the next generation of hash functions is to be multi-property preserving, namely that one should have a single transform that is simultaneously at least collision-resistance preserving, pseudorandom function preserving and PRO-Pr. We present an efficient new transform that is proven to be multi-property preserving in this sense.
Ref: An extended abstract of this paper appeared in Advances in Cryptology - Asiacrypt 2006 Proceedings, Lecture Notes in Computer Science Vol. 4284, X. Lai and K. Chen eds, Springer-Verlag, 2006.
Full paper: Available as compressed postscript, postscript, or pdf. (Help if this doesn't work).