4 ms·

Not if the second-preimage attack is properly defined to find a second distinct document with the same hash as the first.

• eridius 10y ago
  If you can do a first-preimage attack, then just keep doing it until you get a distinct document. I'm not sure what sort of first-preimage attack you have in mind that is only capable of producing a single preimage for any hash.
  • ddlatham 10y ago
    Since the parent was claiming that first-preimage attacks were strictly more severe, which seems to be a theoretical claim for all possible first-preimage attacks, I was pointing out that doesn't necessarily hold. First-preimage attacks are not guaranteed a priori to be able to produce multiple distinct documents for a given hash.
    • eridius 10y ago
      I think the argument here is twofold: 1) If you have some first-preimage attack against a hash, that attack can probably be "continued" such that it produces multiple preimages. 2) Even if your attack can only ever produce one preimage, since there's an infinite number of documents that can produce the same hash, it's vanishingly unlikely that your attack will produce the exact preimage that you already have (note: this is assuming a cryptographically secure hash, where all outputs are equally likely). Therefore, even if you can only get one preimage, it's still almost certainly a second preimage.