> Under what assumptions and definitions is this true? For strong collision resistance and provisional preimage resistance. For example, a hash function of the

> Under what assumptions and definitions is this true? For strong collision resistance and provisional preimage resistance. For example, a hash function of the form f: {0, 1}^* -> {0, 1}^n is certainly preimage resistant if the domain is at least twice as large as the range. More generally, collision resistance implies preimage resistance up to 2^(n/2) (the birthday bound). In practice hash functions compress the space of inputs to a significantly smaller space of outputs; in an academic setting we divide between provisional and strong implications of preimage resistance, but for quantum-resistant hash-based signatures the provisional implication is sufficient. That also means we generally are more heavily prioritizing second preimage resistance and indistinguishability. This might also be helpful: https://crypto.stackexchange.com/questions/34689/how-to-construct-a-collision-resistant-hash-function-that-is-not-a-one-way-funct https://crypto.stackexchange.com/questions/34689/how-to-cons...