On: Deprecating SHA1

[tptacek]

If one of your hashes is iterated, you also have the multicollision problem: once you find a collision in your weak, iterated hash, you can quickly produce more collisions, so that the strength of your construction just devolves to that of the stronger hash.

[delhanty → tptacek]

For clarity, which part of petertodd's comment are you replying to?

(I'm learning a little cryptography from this thread, so the above is a straight question.)

[bawolff → delhanty]

I believe he is responding to "Two different hashing schemes applied in parallel is better."

My understanding is if you have a collision in the stronger function, you have an infinite family of collisions in the stronger function due to the length extension attack, from there you should be able to base the collision for the weaker function on one of the stronger function's (length extended) collisions.

[delhanty → bawolff]

Thank you for that reply - particularly the informative explanation.

I was sort of assuming it must be a reference to the parallel schemes because with SHA256(MD5(x)), once you had an MD5 collision you would be done.