On a conditional collision attack on nasha-512

Abstract

A collision attack on NaSHA-512 was proposed by L. Ji et al. The claimed complexity of the attack is 2192. The proposed attack is realized by using a suitable differential pattern. In this note we show that the correct result that can be inferred from their differential pattern is in fact a conditional one. It can be stated correctly as follows: A collision attack on NaSHA-512 of complexity k = 1, 2, . . . , 2 320 can be performed with an unknown probability of success pk, where 0 ≤ p1 ≤ p2 ≤ p2 320 ≤ 1. Consequently, the attack proposed by L. Ji et al. can be considered only as a direction how a possible collision attack on NaSHA-512 could be realized. The birthday attack remains the best possible attack on NaSHA-512.