Collisionful keyed hash functions with selectable collisions

Abstract

One-way hash functions (keyed and unkeyed) are often required to be also collision-resistant — that is, finding two inputs that map to the same output is computationally hard. Recently, applications using user-chosen passwords suggest that keyed one-way hash functions be collisionful instead of collision-resistant on the key component in order to protect the passwords from guessing attacks. We give a new construction of collisionful keyed one-way hash function where one can select and reuse some of the collisions to better confuse a guessing attack.