Abstract

Indifferentiability of iterated hash functions is seen as evidence that there are no structural flaws in the iteration structure of the algorithm. However, it is often overlooked that such considerations only hold in the random oracle model and do not give any guarantee in the standard model. In this article, we show the following separation result: there is a hash function that is indifferentiable from a random oracle, but is totally insecure in the standard model. In particular, we show that it does not satisfy collision or multicollision-resistance, second preimage-resistance or preimage-resistance for any family of compression functions. Therefore, at least in theory, hash function indifferentiability does not guarantee the structural integrity of the hash algorithm in the standard model. Results in the random oracle model are not affected.