Limited-birthday Distinguishers for Hash Functions Collisions Beyond the Birthday Bound can be Meaningful

Abstract. In this article, we investigate the use of limited-birthday distinguishers to the context of hash functions. We rst provide a proper understanding of the limited-birthday problem and demonstrate its soundness by using a new security notion Di erential Target Collision Resistance (dTCR) that is related to the classical Target Collision Resistance (TCR) notion. We then solve an open problem and close the existing security gap by proving that the best known generic attack proposed at FSE 2010 for the limited-birthday problem is indeed the best possible method. Moreover, we show that almost all known collision attacks are in fact more than just a collision nding algorithm, since the di erence mask for the message input is usually xed. A direct and surprising corollary is that these collision attacks are interesting for cryptanalysis even when their complexity goes beyond the 2 n/2 birthday bound and up to th