[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-seo-243849-105":3,"detail-sidebar-cat-1-en-105":81,"doc-detail-243849-en":127},{"code":4,"msg":5,"data":6},0,"ok",{"site_id":7,"language":8,"slug":9,"title":10,"keywords":11,"description":12,"schema_data":13,"social_meta":74,"head_meta":76,"extra_data":78,"updated_unix":80},105,"en","block-cipher-based-tree-hashing-aldo-gunsing","Block-Cipher-Based Tree Hashing - Aldo Gunsing","","The work analyzes a fundamental error in tree-based hashing research related to indifferentiability proofs under multiple oracles. It shows the mistake goes beyond previously reported bounds issues by shifting the security claim from the standard indifferentiability model to the weaker sequential indifferentiability one. The paper explains how the oversight arises and proposes ways to avoid it, then revises the Daemen et al. construction to restore security bounds across multiple finalization functions and introduces the tree sponge as a parallel sequential sponge generalization.",{"@graph":14,"@context":73},[15,34,56],{"@type":16,"itemListElement":17},"BreadcrumbList",[18,23,27,31],{"item":19,"name":20,"@type":21,"position":22},"https://docshare.wps.com","Home","ListItem",1,{"item":24,"name":25,"@type":21,"position":26},"https://docshare.wps.com/template/","Template",2,{"item":28,"name":29,"@type":21,"position":30},"https://docshare.wps.com/template/presentations/","Presentations",3,{"item":32,"name":10,"@type":21,"position":33},"https://docshare.wps.com/template/block-cipher-based-tree-hashing-aldo-gunsing/243849/",4,{"url":32,"name":10,"@type":35,"image":36,"author":41,"headline":10,"publisher":44,"fileFormat":47,"inLanguage":8,"description":12,"dateModified":48,"datePublished":49,"encodingFormat":47,"isAccessibleForFree":50,"interactionStatistic":51},"DigitalDocument",{"url":37,"@type":38,"width":39,"height":40},"https://docshare.wps.com/thumbnails/block-cipher-based-tree-hashing-aldo-gunsing/243849.png","ImageObject",442,249,{"name":42,"@type":43},"McQueen","Person",{"url":19,"name":45,"@type":46},"DocShare","Organization","application/pdf","2026-10-19","2026-09-12",true,{"@type":52,"interactionType":53,"userInteractionCount":55},"InteractionCounter",{"@type":54},"ViewAction",7,{"@type":57,"mainEntity":58},"FAQPage",[59,65,69],{"name":60,"@type":61,"acceptedAnswer":62},"What error does the document identify in tree-based hashing papers?","Question",{"text":63,"@type":64},"It identifies an essential oversight in how different oracles interact within indifferentiability proofs, causing the claim to rely on sequential indifferentiability rather than the standard model.","Answer",{"name":66,"@type":61,"acceptedAnswer":67},"How does the paper explain the origin of the oversight?",{"text":68,"@type":64},"It discusses how the interaction between oracles in the indifferentiability setting leads to the reduced claim and shows that the same kind of error appeared in earlier indifferentiability works.",{"name":70,"@type":61,"acceptedAnswer":71},"How can the security bound issues be resolved?",{"text":72,"@type":64},"By generalizing the Daemen et al. construction to allow any finalization function and evaluating five finalization types, including results on SHA-2 feed-forward dropping and security considerations for BLAKE3 and the tree sponge approach.","https://schema.org",{"og:url":32,"og:type":75,"og:title":10,"og:site_name":45,"og:description":12},"article",{"robots":77,"canonical":32},"index,follow",{"doc_id":79,"site_id":7},243849,1789209340,{"code":4,"msg":82,"data":83},"success",[84,88,93,98,103,108,113,118,123],{"id":85,"doc_module":22,"doc_module_name":25,"category_name":29,"show_sort_weight":86,"slug":87},11,90,"presentations",{"id":89,"doc_module":22,"doc_module_name":25,"category_name":90,"show_sort_weight":91,"slug":92},12,"Resumes",80,"resumes",{"id":94,"doc_module":22,"doc_module_name":25,"category_name":95,"show_sort_weight":96,"slug":97},14,"Invoices",70,"invoices",{"id":99,"doc_module":22,"doc_module_name":25,"category_name":100,"show_sort_weight":101,"slug":102},15,"Posters",60,"posters",{"id":104,"doc_module":22,"doc_module_name":25,"category_name":105,"show_sort_weight":106,"slug":107},16,"Social Media",50,"social-media",{"id":109,"doc_module":22,"doc_module_name":25,"category_name":110,"show_sort_weight":111,"slug":112},17,"Forms",40,"forms",{"id":114,"doc_module":22,"doc_module_name":25,"category_name":115,"show_sort_weight":116,"slug":117},18,"Letters",30,"letters",{"id":119,"doc_module":22,"doc_module_name":25,"category_name":120,"show_sort_weight":121,"slug":122},21,"Paper Templates",5,"papers-templates",{"id":124,"doc_module":22,"doc_module_name":25,"category_name":125,"show_sort_weight":4,"slug":126},158,"General","general-158",{"code":4,"msg":82,"data":128},{"doc_id":79,"user_id":129,"nickname":42,"user_avatar":130,"doc_module":22,"category_id":85,"category_name":29,"doc_title":10,"doc_description":12,"doc_content":131,"file_id":132,"file_url":133,"file_type":134,"file_size":135,"view_count":55,"is_deleted":4,"is_public":22,"is_downloadable":22,"audit_status":22,"page_count":106,"language":136,"language_code":8,"site_id":7,"html_lang":8,"table_of_contents":137,"faqs":138,"seo_title":139,"seo_description":12,"update_tm":80,"read_time":114},5909890329169,"https://ap-avatar.wpscdn.com/davatar_9964176cb1d06d4a9deccf72a44ae3dc","Block-Cipher-Based Tree Hashing  \nAldo Gunsing  \nDigital Security Group, Radboud University, Nijmegen, The Netherlands  \n[aldo.gunsing@ru.nl](aldo.gunsing@ru.nl)  \nAbstract. First of all we take a thorough look at an error in a paper by Daemen et al. (ToSC 2018) which looks at minimal requirements for tree-based hashing based on multiple primitives, including block ciphers.  \nThis reveals that the error is more fundamental than previously shown by Gunsing et al. (ToSC 2020), which is mainly interested in its effect on the security bounds. It turns out that the cause for the error is due to an essential oversight in the interaction between the different oracles used in the indifferentiability proofs. In essence, it reduces the claim from the normal indifferentiability setting to the weaker sequential indifferentiability one. As a matter of fact, this error appeared in multiple earlier indifferentiability papers, including the optimal indifferentiability of the sum of permutations (EUROCRYPT 2018) and the recent ABR+ construction (EUROCRYPT 2021) . We discuss in detail how this oversight is caused and how it can be avoided.  \nWe next demonstrate how the negative effects on the security bound of the construction by Daemen et al. can be resolved. Instead of only allowing a truncated output, we generalize the construction to allow for any finalization function and investigate the security of this for five different types of finalization. Our findings, among others, show that the security of the SHA-2 mode does not degrade if the feed-forward is dropped and that the modern BLAKE3 construction is secure in principle but that its use of the extendable output requires its counter used for random access to be public. Finally, we introduce the tree sponge, a generalization of the sequential sponge construction with parallel absorbing and squeezing.  \nKeywords: Hash Functions, Block Ciphers, Tree Hashing, Indifferentiability  \n1 Introduction  \n1.1 Hash Functions  \nHash functions, which are functions H : {0, 1}∗ → {0, 1}n that compress an arbitrarily-sized message M to a fixed sized output h, form a fundamental part of many cryptographic constructions. In practice they are not built directly, but from a smaller compression function that only takes a fixed sized input, for example f : {0, 1}2n → {0, 1}n. A popular and simple method for this is the Merkle-Damg˚ard construction [Mer89, Dam89], which uses a fixed-sized compression function in a sequential manner to obtain the hash digest. This construction  \n2 Aldo Gunsing  \nis sometimes ‘strengthened’ by appending an encoding of the length of the message to the end, giving a collision resistant hash function as long as the internal compression function is collision resistant, a fact proven by Merkle and Damg˚ard independently.  \nHowever, it turned out that collision resistance is not strong enough for some situations. For example, strengthened Merkle-Damg˚ard is susceptible to another attack, called the length extension attack: given the hash digest H (M) of a message M and its length |M| it is possible to compute H(pad(M) ∥ M′) for any M′, without knowing the original message M. This is possible as the digest H (M) leaks the internal state of the hash function when the blocks of pad(M) are processed. By using this state as the initial value, it is straightforward to compute H(pad(M) ∥ M′) for any M′. This is especially troublesome when the function is used in the keyed fashion as H (K ∥ M), noting it should be possible to build a MAC in this way, as the output of the hash should be unpredictable when K is unknown. The attack above shows that this construction is insecure when the hash function is instantiated with (strengthened) Merkle-Damg˚ard, even when the internal compression function is secure. A remedy for this is the HMAC construction [KBC97, Bel06], but this is less efficient and unsatisfying.  \nThis weakness asks for a more sophisticated security analysis for hash functions, namely ","cbCaiq1Oy6Ii5tvM","https://ap.wps.com/l/cbCaiq1Oy6Ii5tvM","pdf",558035,"English","# Introduction\n## Hash Functions\n## Previous Work","[{\"question\":\"What error does the document identify in tree-based hashing papers?\",\"answer\":\"It identifies an essential oversight in how different oracles interact within indifferentiability proofs, causing the claim to rely on sequential indifferentiability rather than the standard model.\"},{\"question\":\"How does the paper explain the origin of the oversight?\",\"answer\":\"It discusses how the interaction between oracles in the indifferentiability setting leads to the reduced claim and shows that the same kind of error appeared in earlier indifferentiability works.\"},{\"question\":\"How can the security bound issues be resolved?\",\"answer\":\"By generalizing the Daemen et al. construction to allow any finalization function and evaluating five finalization types, including results on SHA-2 feed-forward dropping and security considerations for BLAKE3 and the tree sponge approach.\"}]","Block-Cipher-Based Tree Hashing - Aldo Gunsing | PDF"]