Compression function design principles supporting variable output lengths from a single small function

Abstract

In this paper, we introduce new compression function design principles supporting variable output lengths (multiples of size n). They are based on a function or block cipher with an n-bit output size. In the case of the compression function with a (t + 1)n-bit output size, in the random oracle and ideal cipher models, their maximum advantages from the perspective of collision resistance are O(t(2)q/2(tn) + q(2)/2((r + 1)n)). In the case of t = 1, the advantage is near-optimal. In the case of t > 1, the advantage is optimal.