{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,6,10]],"date-time":"2026-06-10T07:48:36Z","timestamp":1781077716821,"version":"3.54.1"},"publisher-location":"Cham","reference-count":33,"publisher":"Springer Nature Switzerland","isbn-type":[{"value":"9783031159817","type":"print"},{"value":"9783031159824","type":"electronic"}],"license":[{"start":{"date-parts":[[2022,1,1]],"date-time":"2022-01-01T00:00:00Z","timestamp":1640995200000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.springer.com\/tdm"},{"start":{"date-parts":[[2022,1,1]],"date-time":"2022-01-01T00:00:00Z","timestamp":1640995200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.springer.com\/tdm"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2022]]},"DOI":"10.1007\/978-3-031-15982-4_5","type":"book-chapter","created":{"date-parts":[[2022,10,11]],"date-time":"2022-10-11T04:40:54Z","timestamp":1665463254000},"page":"131-160","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":10,"title":["Time-Space Tradeoffs for\u00a0Sponge Hashing: Attacks and\u00a0Limitations for\u00a0Short Collisions"],"prefix":"10.1007","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-6307-204X","authenticated-orcid":false,"given":"Cody","family":"Freitag","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-2436-0230","authenticated-orcid":false,"given":"Ashrujit","family":"Ghoshal","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-1647-2112","authenticated-orcid":false,"given":"Ilan","family":"Komargodski","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"297","published-online":{"date-parts":[[2022,10,12]]},"reference":[{"key":"5_CR1","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"357","DOI":"10.1007\/978-3-319-70697-9_13","volume-title":"Advances in Cryptology \u2013 ASIACRYPT 2017","author":"H Abusalah","year":"2017","unstructured":"Abusalah, H., Alwen, J., Cohen, B., Khilko, D., Pietrzak, K., Reyzin, L.: Beyond Hellman\u2019s time-memory trade-offs with applications to proofs of space. In: Takagi, T., Peyrin, T. (eds.) ASIACRYPT 2017, Part II. LNCS, vol. 10625, pp. 357\u2013379. Springer, Cham (2017). https:\/\/doi.org\/10.1007\/978-3-319-70697-9_13"},{"key":"5_CR2","doi-asserted-by":"crossref","unstructured":"Adleman, L.: Two theorems on random polynomial time. In: 19th Annual Symposium on Foundations of Computer Science (SDCS 1978), pp. 75\u201383 (1978)","DOI":"10.1109\/SFCS.1978.37"},{"key":"5_CR3","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"157","DOI":"10.1007\/978-3-030-56784-2_6","volume-title":"Advances in Cryptology \u2013 CRYPTO","author":"X Akshima","year":"2020","unstructured":"Akshima, X., Cash, D., Drucker, A., Wee, H.: Time-space tradeoffs and short collisions in Merkle-Damg\u00e5rd hash functions. In: Micciancio, D., Ristenpart, T. (eds.) CRYPTO 2020. LNCS, vol. 12170, pp. 157\u2013186. Springer, Cham (2020). https:\/\/doi.org\/10.1007\/978-3-030-56784-2_6"},{"key":"5_CR4","doi-asserted-by":"crossref","unstructured":"Akshima, Guo, S., Liu, Q.: Time-space lower bounds for finding collisions in Merkle-Damg\u00e5rd hash functions. In: Dodis, Y., Shrimpton, T. (eds.) CRYPTO 2022, LNCS 13509, pp. 192\u2013221 (2022)","DOI":"10.1007\/978-3-031-15982-4_7"},{"key":"5_CR5","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1007\/11818175_1","volume-title":"Advances in Cryptology - CRYPTO 2006","author":"E Barkan","year":"2006","unstructured":"Barkan, E., Biham, E., Shamir, A.: Rigorous bounds on cryptanalytic time\/memory tradeoffs. In: Dwork, C. (ed.) CRYPTO 2006. LNCS, vol. 4117, pp. 1\u201321. Springer, Heidelberg (2006). https:\/\/doi.org\/10.1007\/11818175_1"},{"key":"5_CR6","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"321","DOI":"10.1007\/978-3-642-42045-0_17","volume-title":"Advances in Cryptology - ASIACRYPT 2013","author":"DJ Bernstein","year":"2013","unstructured":"Bernstein, D.J., Lange, T.: Non-uniform cracks in the concrete: the power of free precomputation. In: Sako, K., Sarkar, P. (eds.) ASIACRYPT 2013, Part II. LNCS, vol. 8270, pp. 321\u2013340. Springer, Heidelberg (2013). https:\/\/doi.org\/10.1007\/978-3-642-42045-0_17"},{"key":"5_CR7","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"181","DOI":"10.1007\/978-3-540-78967-3_11","volume-title":"Advances in Cryptology \u2013 EUROCRYPT 2008","author":"G Bertoni","year":"2008","unstructured":"Bertoni, G., Daemen, J., Peeters, M., Van Assche, G.: On the indifferentiability of the sponge construction. In: Smart, N. (ed.) EUROCRYPT 2008. LNCS, vol. 4965, pp. 181\u2013197. Springer, Heidelberg (2008). https:\/\/doi.org\/10.1007\/978-3-540-78967-3_11"},{"key":"5_CR8","unstructured":"Bertoni, G., Daemen, J., Peeters, M., Van Assche, G.: Sponge functions. In: ECRYPT Hash Workshop. Citeseer (2007)"},{"key":"5_CR9","unstructured":"Bertoni, G., Daemen, J., Peeters, M., Van Assche, G.: On the security of the keyed sponge construction. In: Symmetric Key Encryption Workshop (2011)"},{"key":"5_CR10","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"693","DOI":"10.1007\/978-3-319-96884-1_23","volume-title":"Advances in Cryptology \u2013 CRYPTO 2018","author":"S Coretti","year":"2018","unstructured":"Coretti, S., Dodis, Y., Guo, S.: Non-uniform bounds in the random-permutation, ideal-cipher, and generic-group models. In: Shacham, H., Boldyreva, A. (eds.) CRYPTO 2018, Part I. LNCS, vol. 10991, pp. 693\u2013721. Springer, Cham (2018). https:\/\/doi.org\/10.1007\/978-3-319-96884-1_23"},{"key":"5_CR11","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"227","DOI":"10.1007\/978-3-319-78381-9_9","volume-title":"Advances in Cryptology \u2013 EUROCRYPT 2018","author":"S Coretti","year":"2018","unstructured":"Coretti, S., Dodis, Y., Guo, S., Steinberger, J.: Random oracles and non-uniformity. In: Nielsen, J.B., Rijmen, V. (eds.) EUROCRYPT 2018, Part I. LNCS, vol. 10820, pp. 227\u2013258. Springer, Cham (2018). https:\/\/doi.org\/10.1007\/978-3-319-78381-9_9"},{"key":"5_CR12","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"415","DOI":"10.1007\/978-3-319-78375-8_14","volume-title":"Advances in Cryptology \u2013 EUROCRYPT 2018","author":"H Corrigan-Gibbs","year":"2018","unstructured":"Corrigan-Gibbs, H., Kogan, D.: The discrete-logarithm problem with\u00a0preprocessing. In: Nielsen, J.B., Rijmen, V. (eds.) EUROCRYPT 2018, Part II. LNCS, vol. 10821, pp. 415\u2013447. Springer, Cham (2018). https:\/\/doi.org\/10.1007\/978-3-319-78375-8_14"},{"key":"5_CR13","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"393","DOI":"10.1007\/978-3-030-36030-6_16","volume-title":"Theory of Cryptography","author":"H Corrigan-Gibbs","year":"2019","unstructured":"Corrigan-Gibbs, H., Kogan, D.: The function-inversion problem: barriers and opportunities. In: Hofheinz, D., Rosen, A. (eds.) TCC 2019, Part I. LNCS, vol. 11891, pp. 393\u2013421. Springer, Cham (2019). https:\/\/doi.org\/10.1007\/978-3-030-36030-6_16"},{"key":"5_CR14","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"203","DOI":"10.1007\/3-540-39118-5_19","volume-title":"Advances in Cryptology \u2014 EUROCRYPT\u2019 87","author":"IB Damg\u00e5rd","year":"1988","unstructured":"Damg\u00e5rd, I.B.: Collision free hash functions and public key signature schemes. In: Chaum, D., Price, W.L. (eds.) EUROCRYPT 1987. LNCS, vol. 304, pp. 203\u2013216. Springer, Heidelberg (1988). https:\/\/doi.org\/10.1007\/3-540-39118-5_19"},{"key":"5_CR15","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"649","DOI":"10.1007\/978-3-642-14623-7_35","volume-title":"Advances in Cryptology \u2013 CRYPTO 2010","author":"A De","year":"2010","unstructured":"De, A., Trevisan, L., Tulsiani, M.: Time space tradeoffs for attacks against one-way functions and PRGs. In: Rabin, T. (ed.) CRYPTO 2010. LNCS, vol. 6223, pp. 649\u2013665. Springer, Heidelberg (2010). https:\/\/doi.org\/10.1007\/978-3-642-14623-7_35"},{"key":"5_CR16","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"473","DOI":"10.1007\/978-3-319-56614-6_16","volume-title":"Advances in Cryptology \u2013 EUROCRYPT 2017","author":"Y Dodis","year":"2017","unstructured":"Dodis, Y., Guo, S., Katz, J.: Fixing cracks in the concrete: random oracles with auxiliary input, revisited. In: Coron, J.-S., Nielsen, J.B. (eds.) EUROCRYPT 2017, Part II. LNCS, vol. 10211, pp. 473\u2013495. Springer, Cham (2017). https:\/\/doi.org\/10.1007\/978-3-319-56614-6_16"},{"issue":"3","key":"5_CR17","doi-asserted-by":"publisher","first-page":"790","DOI":"10.1137\/S0097539795280512","volume":"29","author":"A Fiat","year":"1999","unstructured":"Fiat, A., Naor, M.: Rigorous time\/space trade-offs for inverting functions. SIAM J. Comput. 29(3), 790\u2013803 (1999)","journal-title":"SIAM J. Comput."},{"key":"5_CR18","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"420","DOI":"10.1007\/978-3-662-45611-8_22","volume-title":"Advances in Cryptology \u2013 ASIACRYPT 2014","author":"P-A Fouque","year":"2014","unstructured":"Fouque, P.-A., Joux, A., Mavromati, C.: Multi-user collisions: applications to discrete logarithm, Even-Mansour and PRINCE. In: Sarkar, P., Iwata, T. (eds.) ASIACRYPT 2014, Part I. LNCS, vol. 8873, pp. 420\u2013438. Springer, Heidelberg (2014). https:\/\/doi.org\/10.1007\/978-3-662-45611-8_22"},{"key":"5_CR19","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"87","DOI":"10.1007\/978-3-662-49890-3_4","volume-title":"Advances in Cryptology \u2013 EUROCRYPT 2016","author":"P Ga\u017ei","year":"2016","unstructured":"Ga\u017ei, P., Tessaro, S.: Provably robust sponge-based PRNGs and KDFs. In: Fischlin, M., Coron, J.-S. (eds.) EUROCRYPT 2016, Part I. LNCS, vol. 9665, pp. 87\u2013116. Springer, Heidelberg (2016). https:\/\/doi.org\/10.1007\/978-3-662-49890-3_4"},{"key":"5_CR20","doi-asserted-by":"crossref","unstructured":"Gennaro, R., Trevisan, L.: Lower bounds on the efficiency of generic cryptographic constructions. In: 41st Annual Symposium on Foundations of Computer Science, FOCS, pp. 305\u2013313. IEEE Computer Society (2000)","DOI":"10.1109\/SFCS.2000.892119"},{"key":"5_CR21","doi-asserted-by":"crossref","unstructured":"Ghoshal, A., Komargodski, I.: On time-space tradeoffs for bounded-length collisions in Merkle-Damg\u00e5rd hashing (2022)","DOI":"10.1007\/978-3-031-15982-4_6"},{"key":"5_CR22","doi-asserted-by":"crossref","unstructured":"Golovnev, A., Guo, S., Horel, T., Park, S., Vaikuntanathan, V.: Data structures meet cryptography: 3SUM with preprocessing. In: 52nd Annual ACM SIGACT Symposium on Theory of Computing, STOC, pp. 294\u2013307 (2020)","DOI":"10.1145\/3357713.3384342"},{"issue":"4","key":"5_CR23","doi-asserted-by":"publisher","first-page":"401","DOI":"10.1109\/TIT.1980.1056220","volume":"26","author":"ME Hellman","year":"1980","unstructured":"Hellman, M.E.: A cryptanalytic time-memory trade-off. IEEE Trans. Inf. Theory 26(4), 401\u2013406 (1980)","journal-title":"IEEE Trans. Inf. Theory"},{"key":"5_CR24","unstructured":"Merkle, R.C.: Secrecy, authentication and public key systems. Ph.D. thesis, UMI Research Press, Ann Arbor, Michigan (1982)"},{"key":"5_CR25","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"369","DOI":"10.1007\/3-540-48184-2_32","volume-title":"Advances in Cryptology \u2014 CRYPTO \u201987","author":"RC Merkle","year":"1988","unstructured":"Merkle, R.C.: A digital signature based on a conventional encryption function. In: Pomerance, C. (ed.) CRYPTO 1987. LNCS, vol. 293, pp. 369\u2013378. Springer, Heidelberg (1988). https:\/\/doi.org\/10.1007\/3-540-48184-2_32"},{"key":"5_CR26","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"218","DOI":"10.1007\/0-387-34805-0_21","volume-title":"Advances in Cryptology \u2014 CRYPTO\u2019 89 Proceedings","author":"RC Merkle","year":"1990","unstructured":"Merkle, R.C.: A certified digital signature. In: Brassard, G. (ed.) CRYPTO 1989. LNCS, vol. 435, pp. 218\u2013238. Springer, New York (1990). https:\/\/doi.org\/10.1007\/0-387-34805-0_21"},{"key":"5_CR27","unstructured":"Mihalcik, J.: An analysis of algorithms for solving discrete logarithms in fixed groups. Technical report, Naval Postgraduate School, Monterey, CA (2010)"},{"issue":"3","key":"5_CR28","first-page":"46:1","volume":"50","author":"P Morin","year":"2017","unstructured":"Morin, P., Mulzer, W., Reddad, T.: Encoding arguments. ACM Comput. Surv. 50(3), 46:1-46:36 (2017)","journal-title":"ACM Comput. Surv."},{"key":"5_CR29","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"617","DOI":"10.1007\/978-3-540-45146-4_36","volume-title":"Advances in Cryptology - CRYPTO 2003","author":"P Oechslin","year":"2003","unstructured":"Oechslin, P.: Making a faster cryptanalytic time-memory trade-off. In: Boneh, D. (ed.) CRYPTO 2003. LNCS, vol. 2729, pp. 617\u2013630. Springer, Heidelberg (2003). https:\/\/doi.org\/10.1007\/978-3-540-45146-4_36"},{"issue":"11","key":"5_CR30","doi-asserted-by":"publisher","first-page":"594","DOI":"10.1145\/359168.359172","volume":"22","author":"R Morris","year":"1979","unstructured":"Morris, R., Thompson, K.: Password security - a case history. Commun. ACM 22(11), 594\u2013597 (1979)","journal-title":"Commun. ACM"},{"key":"5_CR31","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"205","DOI":"10.1007\/978-3-540-74143-5_12","volume-title":"Advances in Cryptology - CRYPTO 2007","author":"D Unruh","year":"2007","unstructured":"Unruh, D.: Random oracles and auxiliary input. In: Menezes, A. (ed.) CRYPTO 2007. LNCS, vol. 4622, pp. 205\u2013223. Springer, Heidelberg (2007). https:\/\/doi.org\/10.1007\/978-3-540-74143-5_12"},{"key":"5_CR32","doi-asserted-by":"crossref","unstructured":"Wee, H.: On obfuscating point functions. In: 37th Annual ACM Symposium on Theory of Computing, STOC, pp. 523\u2013532 (2005)","DOI":"10.1145\/1060590.1060669"},{"key":"5_CR33","doi-asserted-by":"crossref","unstructured":"Yao, A.C.: Coherent functions and program checkers (extended abstract). In: STOC, pp. 84\u201394 (1990)","DOI":"10.1145\/100216.100226"}],"container-title":["Lecture Notes in Computer Science","Advances in Cryptology \u2013 CRYPTO 2022"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/978-3-031-15982-4_5","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,10]],"date-time":"2025-10-10T22:04:45Z","timestamp":1760133885000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/978-3-031-15982-4_5"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2022]]},"ISBN":["9783031159817","9783031159824"],"references-count":33,"URL":"https:\/\/doi.org\/10.1007\/978-3-031-15982-4_5","relation":{},"ISSN":["0302-9743","1611-3349"],"issn-type":[{"value":"0302-9743","type":"print"},{"value":"1611-3349","type":"electronic"}],"subject":[],"published":{"date-parts":[[2022]]},"assertion":[{"value":"12 October 2022","order":1,"name":"first_online","label":"First Online","group":{"name":"ChapterHistory","label":"Chapter History"}},{"value":"CRYPTO","order":1,"name":"conference_acronym","label":"Conference Acronym","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Annual International Cryptology Conference","order":2,"name":"conference_name","label":"Conference Name","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Santa Barbara, CA","order":3,"name":"conference_city","label":"Conference City","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"USA","order":4,"name":"conference_country","label":"Conference Country","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"2022","order":5,"name":"conference_year","label":"Conference Year","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"15 August 2022","order":7,"name":"conference_start_date","label":"Conference Start Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"18 August 2022","order":8,"name":"conference_end_date","label":"Conference End Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"42","order":9,"name":"conference_number","label":"Conference Number","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"crypto2022","order":10,"name":"conference_id","label":"Conference ID","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"https:\/\/crypto.iacr.org\/2022\/","order":11,"name":"conference_url","label":"Conference URL","group":{"name":"ConferenceInfo","label":"Conference Information"}}]}}