It’s actually not much harder at all, as first noted by Joux, “Multicollisions i...

anderskaseorg on Feb 23, 2017 | parent | context | favorite | on: Announcing the first SHA-1 collision

It’s actually not much harder at all, as first noted by Joux, “Multicollisions in iterated hash functions. Application to cascaded constructions”, 2004.

https://www.iacr.org/archive/crypto2004/31520306/multicollis...

AlexandrB on Feb 23, 2017 [–]

Thanks, this is fascinating!