See discussions, stats, and author profiles for this publication at: https://www.researchgate.

net/publication/227290926

F.F.T. Hashing is not Collision-free

Conference Paper · January 1995

DOI: 10.1007/3-540-47555-9_3

CITATIONS READS

5 22

3 authors, including:

Henri Gilbert Marc Girault

ANSSI France Orange Labs
100 PUBLICATIONS   2,949 CITATIONS    51 PUBLICATIONS   1,577 CITATIONS   

SEE PROFILE SEE PROFILE

All content following this page was uploaded by Henri Gilbert on 12 May 2016.

The user has requested enhancement of the downloaded file.

 F.F.T. Hashing is not Collision-free

T. BARITAUD * , H. GILBERT * , M. GIRAULT **

(*) CNET PAAITSAISRC (**) SEF'T PEM

38 - 40. avcnuc du GQCral Lcclcrc 42. NC dcs Coutum
92131 ISSY LFS MOULINEAUX (Francc) BP 6243
14066 CAEN (Francc)

Abstract

The F I T Hmhing Function proposed by C.P.Schwrr [I] h h e s messages of arbitrary length inlo a 128-
bit hash value. I n this paper, we show that this function is not collision fiee, and we give an example of
two disrinct 256-bit messages with the same hask value. Finding a collision (in facr a large family 01
23
colliding messages) requires approrimalely 2 parrial cornpiations of rhe hash function, and takes 0 few
hours on a SUN3-workstation. and less than an hour on a SPARC-workstation.

A similar resuli discovered independently has k e n announced at the AsiacryprPI rump session by
Dnemen -Bosselaers-Covaerts-Vandewalle [2 1.

1 The FFT Hashing Function

1.1 The Hash algorithm

Let the messagc be given as a bit string mlm 2...ml of L bit.

Thc mcssagc is first p d d c d so that its lcngth (in bits) bccomcs a multiplc of 128. Lct thc paddcd rncssagc
MI% ... Mn consist oln blocks MI,.__
,Mn ,wch of thc Mi ( k l , _..3) k i n g 128-bit long.

Thc algorithm uses a constanl initial value Ho givcn in hexadecimal as

128
Ho = 0123 4S67 89ab cdcf fcdc ba98 7654 3210 in (0.11 .
R.A. Rueppel (Ed.): Advances in Cryptology - EUROCRYPT '92, LNCS 658, pp. 35-44, 1993
0 Springer-Verlag Berlin Heidelberg 1993
 298
36

16
LCIp bcInthcgeneral, in computational
p r i m 65537 = 2 + 1. security, most results have a non-uniform and a
uniform version (depending on which model of security is chosen). Historically, non-
8 8
uniform
Wc will uscresults weretransform
thc Fouricr obtained F first, and
T8 ’. (0. ... ,p-l)
extending (0. ... ,p-l]
------>them to the uniform case is often
a hard task.
Thc main technique for obtaining uniform results is now classical. It an be
(ao, ... ,?) ------>(bp ... ,b7)
found in Levin [5]: it consists in replacing true probabilities by approximations com-
puted from random samplings.
7 4ij
wilh biThe
= purpose
2 aj mod of this
p ,Torpaperi = O ,is...twofold.
,7. We prove that Schrift and Shamir’s next-
bit test j=O
remains universal in the uniform model of security. More importantly, we
initiate a general framework in which the sampling technique can always be applied
to obtainforuniform
Algorithm results.h :Our main theorem specifies some conditions which are
lhc hash function
sufficient to extend a non-uniform result into a uniform one. 111 fact., Ihe universality
of the next-bit test becomes a consequence n. 128of our main theorem.
“PUT
The M IT...
theory: of one-way Mfunctions
n in (0.1)and pseudorandom (a paddd mcwgc) generators involves dif-
ferent notions of resistance of some object against an adversary. Two distributions
are indistinguishable if they resist to be distinguished by a probabilistic polynomial-
Do
time adversary. Hi = g(Hi-]
:A one-way function
,Mi) is = 1 , ... , n which resists to be inverted. A bit
lorai function
is hard-core on a function f if it resists to be predicted using the knowledge off(.).
Several well known results can he restated in terms of reduction of one notion
of resistance
OUTPUT to: another.
h(M) := For Hnexample, the universality of the next-bit test can be
expressed as follows: the resistance of two distributions against an arbitrary adversary
reduces to their resistance against the particular one who tries to distinguish them
by the next-bit prediction. Let us quote a few other:
8.16
- Goldreich-Levin
Algorithm ’‘ ------> [2]:
for g : 2
P
(0, I ]“if thcrc cxists a one-way furiclion, then there exists a
function with a hard-core bit”. This result has been proved in [2] in both models of
security. 16.16
INPUT (coo’... ,cI5) in ( O J I
- Impagliazzo-Levin-Luby: “if there exists a one-way function, then there
exists a pseudorandom generator”. This theorem was first proved under different
types of restrictive1. (CO’C2’... .el&([1],[5]),
assumptions := Fr8(C0.C2, then...in the general case in [4], in the non-
’CI4)
uniform model of security. It was then proved in the uniform model by Hastad [3].
- Rompel 2. [ 6 ] : FOR
“if there ___
i = 0, exists,15 DO a one-way function, then there exists a secure
signature scheme”.
In section 2, we e.give 1
:= c.1a+few 1-2 + cci-3 +2’
c.1-1 e.notations and (modsomep) basic definitions about uniform
and non-uniform computation. In section 3, we formalize the very general notion
of resistance by defining a security scheme and the resistance of a security scheme.
Basically, a security scheme (Thc lowcrisindiccsa predicate i-3, ci-3that
i, i-I, i-2.saying arc takcn
some modulo 16)
algorithm significantly
succeeds in attacking
3. some object.
REPEAT skps 1 and 2 Then we define the reduction between two security
schemes (reduction of a scheme to another means that the problem of proving the
resistance -
of the former reduces to16the same problem for the latter).8.16 Finally we illus-
OUTPUT c . := ci mod 2 , for i = 8, ... .I5 (on clcmcnt of [0.1) )
trate our definitions by1 restating several theorems in terms of reducibility between
security schemes.
In section 4, we introduce the notion of a virtual algorithm which will be crucial
1.2 Notations
for extending non-uniform results to uniform ones. Intuitively, a virtual algorithm
0 .
For a bcllcr clarity of our cxplanation, wc will dcnote by ci (1=0,... ,15) UIc initial ci valucs, and

wc will denotc by slcp 3 (rcsp. step 4) UICsecond pass of step 1 (rcsp. stcp2) in thc algorilhm for g.
k
Whcn it will bc ncccSSary to avoid any kind of slip, we will dcnoic by ci (i=O, .__
.I5 ; k=O, ... ,4)
thc ci inkrmediatc valuc. aflcr slcp k.
 31

In ordcr to simplify thc cxprcssions, wc iuc using lhc following notations :

- Thc additions (x+y), multiplications (x.y) and cxponcnliations (xY) arc implicitly madc modulo
p. cxccpt whcn Lhc opcrands arc lowcr indiccs.
- The = symbol denotcs that thc right and thc lcft t c m s arc cungrucnt modulo p.
- For lowcr indiccs thc additions (i+j) and substractions (i-j) m implicitly madc modulo 16, and
Lhc z symbol dcnotcs lhat thc right and thc Icft tcrrns m congrucnt modulo 16.

1.3 Preliminary remarks

Thc difficulty of finding collisions is rclalcd to thc diffusion propcrlics of lhc hshing funclion, i.c.
thc iiinucncc of il modification of an inarrncdiaa variablc on Ihc subscqucnt variablcs of thc calculation.

Rcrnark 1 (limitation on thc diffusion at skps I and 3)

At stcp 1 and 3, thc input valucs cI, c2. ... ,c I 5 arc kcpt unchangcd.

(limitation on Lhc diffusion at stcps 2 and 4)

c ~ -in~lhc rccurrcncc for stcps 2 and 4 can somclirncs bc
Thc diffusion inlroduccd by thc ~ ~ - , tams

1 1 1
canccllcd (if onc of valucs ei-l and ci-2 is 0). Morc prcciscly. Ict (co, e l , ...,eI5)bc thc input to Sap 2 :

.. 2 1 1
: If for a givcn valuc i in ( 1 . ... ,141 wc havc 2i- 1 = ci+l = 0 and if c,3 f i; cI4 $ i;

1 2 . 1 1 1
c , f~ i; c. f I for j in (0, ... ,121, then thc impact of rcplacing thc input valuc ci by a ncw valuc ei + Aei
1

1 1 1 . . . 2 2
such that ci + Aci i ci ,IS linirtcd to thc output valuc ci (that mcans c. arc not modificd for j fi).
J

.. 1 2 2
: If e14 = co = 0 and if c. ik 15 for j in [ I , ... , I 1 ) thcn Ihc impact or rcplacing Lhc
J
1 1 1 1 1 1 . . 2
input value e
1s
by a new value e15 + Acls such that c , +~ Ac15 c15 , IS limited to thc output valuc cI5.

3 3 3
Similarly, Ict (cl, c2’ ... , cis) bc thc input LO stcp 4 :

.. 4 4 3
m: If for a given valuc i in (1, ... ,14) wc havc ei-l = ei+l = Oand if eI3 & i ;

3 3
c14 # i: c I 5 !j i; ?I J & i for j in (0.___ ,121. hcn thc impact of replacing hc input valuc ci3 by a ncw V ~ U C

3 3
ei + Aci such that c.
3
+ Aci3 z ei3 ,IS
. . 4
limitcd to the ouiput valuc ci .
 38

.. 3 4 4
I

: lfc14 = eo = 0 and ifc. 2 15 lor j in [ I .

J
... , I I ] hcn h e impact olrcplacing thc

3 3 3 3 3 3 4
input value cI5 by a ncw valuc ei5 + Ac15 such that e,5 + AcI5 3 cl5 is limitcd to thc output value elS.

2 Construction or two colliding messages

2.1 Construction of a partial collision

-4
Wc first find two 128-bit blocks M1 and MI1 which hash valucsH1 = ( c 8, ... .-e4 15)md
-4
H 1 = ( c' 8' ... ,-
c' :5)
-4 -4
dilfccr only by thcir right componcnls c 15 and c' Is. Wc will lalcr rclcr to this

. .
propcrty in saying that M Iand MI1 rwlizc a .-

1
Our kchniquc for finding M1and M'l is thc lollowing : we swrch MI valucs such that cI4= 0;

2 3 4 0 0 0
c - 0; c , ~ =
0- -
0; c0- 0. The propositions 2 and 2' suggcst that for such a message M,=(cs. ... ,e,4, c,5),

0 0 0
M1and h e rncssagc M1= (cs, ... , eI4. clS + 16) rcaliu: a partial collision with a significant probability

(approximakly VX).

Them arc two main steps lor finding M1.

0 0 0 0
SlEpl : Sclection of c8, el@eI2 and eI4

0 0 0
Arbilrq (c.g. random) valucs are lakcn for ei2 and c , ~ .Thc valucs of e8 and c& arc thcn dcduced from

hcsc valucs by solving thc lollowing l i n w systcm :

1
0 14 thcn cI4 2 0 0 0 0
If c 13 =
-
= 0 and co = 0 independcnlly of thc valucs of e9, el 1, e13.elS .

Emaf :This is a dircct consequence of the dclinition of hc g runction.

 39

0 0 0 0
2 : Sclcction or c9, c1 1. cI3. cI5

0 0 0 0
Thc valucs of cg, cl0' c12. c14 arc taken from Slcp 1 .

0 0
We fix thc valucs of cI1 = 0 and c15 = 0. An arbitmy (c.g random) valuc is lakcn for 4. wc first

2 3 0 0 0
wlculatc thc cI2 and cI4 valucs comsponding to the choscn valuc or c9, c1 and c15 and lo thc lcmponv

0 0
valuc cI3 = 14. Bascd on thcsc preliminary calculations, wc "correct" thc temporary valuc c , =~ 14 by a

0 0 0
quantity AcY3, i.c. we rcplacc thc valuc c13 = 14 by thc valuc cI3 = 14 + Ac13, and wc l a v e thc othcr

input valucs unchanged. Wc dcnolc by Ac! (KIM ; OSjS15) the corresponding variations Of thc
J
3 3
inlcrmcdiatc variablcs in thc HIcalculation. Wc sclcct A{3 in such a way t h a ~thc quantity c14 + AC14

3 .
(i.c thc ncw valuc of cI4) IS qua1 u, zcro with a good probability.

3
.. 2 -e14 2
&QDUUW!: If C I 2 # 0 and - 0 and c. & 13 lor ISj5ll ihcn thc abovc valucs of
J
e12

3
- '14
1 2 0
,cI5, co and thc valuc AcI3 = -
24.7.7 2
lead to the thrcc rclations
5 2

(4

3 3
c14+ Ac14 = 0 (C)

Erppf : (a) is suaightrorwanl; @) and (c) ;m: d i m ( conscqucnccs of thc lollowing rclalions. which rcsult
from h c dcfinition of thc g function :

We performed a large numbcr n of lrials of stcp 1. For each trial or stcp 1, wc made a largc
0
nurnbcr n2 of lrials of stcp 2. Thc succcss probabilily of stcp 2, i.c thc probability lhal Ihc Uial Or a C9

Vahc lcads Lo a rncssagc such that (a). @) and (c) arc d i x d is slightly less than 1/16 (sincc Ihc strow-
 40

3
-=- 0). Thcrcforc thc probability
-14
condition in proposi tion 2 is : 4.4.7 that a stcp 2 trial lwds to a mcssagc
c12

1 2 3 4 -16 -20
M Isuch that cI4 = co = cI4 = co = 0 is slightly lcss than 1/16.2 = 2 .

Morcovcr, thc probability that such a message M I Imds LO a partial collision is basically the
2 2 4 4
probability that nonc of thc cie3mod 16 indiccs occurring in thc calculation of co lo c15 and co UJc15

23
lakes thc valuc 15. which is closc to 1/8. So, in summary,approxirnadvcly 2 partial computations of thc
0
g function wcrc ncccssary to obkiin a suibblc mcssagc MI = (c8. ... ,{4,cy5), such hat MI and thc

0 0 0 -4
mcssagc M 1 = (c8. ... ,cl4,cI5 + 16) l a d lo partially colliding hash valucs H1= ( c ... ,-c4 ,5) and

-4 -4
W1 = ( c 8, ... c + 16).

2.2 Constructionof a full collision wing a partial collision

0
Wc now show how to find a 128-bit message M2 = (cx, .. , c0, ~ )such that thc previously oblaincd
0
hash valucs H1 and IT1(dcnotcd in &is scction by (co. .. .c,)0 0 0 0
and (dl , .. , c ' ,c',
0 0 0
~ ) = (cl, .. ,c6'c7 + 16) 1

rcspe~tivclylcad to the samc hash valuc H2 (whcn combinul with M2) : g(H1,M2) = g(HI.M2)-

Our kxhniquc lor finding % is quitc similar to the one uscd for finding M I and M,. Let US

i
dcnotc by c. (rcsp c$ (OSi54, BjSl5) thc intermcdiak variablcs of thc calculations or g(HI,M2) (rcsp
J J

gcH'1 MZ)).

2 2
We sciuch % valucs such that c6 = cg = c64 = cx4 = 0. Thc propositions 1 and 1' suggest (hat

4 4 4 4 4 4
probability hat thc lduples (co. .. ,elS) and (do, .. .dI5)dirlcr only by thcir componcnts c7 and c ' ~

which implies that hc probability LO havc g(Hi,M2) = g(HI,%) is quitc subsmtial. appmximadvcly

1fs.
 Thcrc arc two main skps for thc scarch of M2 :

0 0 0 0 0
W 1 :Sclcction of c8, cl0' eI2. cI4. c9.
0 0 0 0 0
An wbiuary (c.g nndom) valuc is takcn for cI4. Thc valucs of c8' cl0' c I 2 an: dcduccd from c14 by

solving Ihc rollowing lincar systcm :

0 0 0
A prcliminvy calculation, whcrc cg, cI1 and e15 arc sct to Lhc tcmporary valuc 0 and $., is sct to IhC

2
tcmporary valuc 14, is madc. Thc obtain4 valuc of c6, dcnolcd by 6. is kcpl.
.. 0 0 0 0
prowsilmo_T: If c8, cl0, el2. c14 an: solutions of (3), (4), (5) and if in addition Ihc values

0 0 0 0 2
eg = p-6. e l l = 0, cI3 = 14, e15 = 0 lcad to inlcrmcdialc valucs such that : c I mod 16 is not in

2 2 2
[9,11.13.15]; c2 mod 16 is no1 in [9,11,13,15]; c3 z 9 mod 16; e4 mod 16 is not in {Y,ll,13,15J;

2 0 0
c5 mod 16 is in (0.6.14). thcn iT wc fix Ihc value c9 = p6, for any valuc of c I 3 3 14 and lor any valuc

0 0
of cI5 such that cI5 I 0 wc havc :

0 0 0 0 0
& ~ :fThc proof of this proposition is casy. Finding thc c8, cl0, cI2' eI4 and c9 valucs satisfying thc

0
conditions of thc abovc proposition is quitc casy. and rcquircs Uic trial of a fcw hundrcds c , valucs.
~

0 0 0
-2 : Sclection of e l l . eI3,e15

0 0 0 0 0
Thc valucs of c8. cID' c12, e14. c9 arc takcn kom stcp 1 ; Ihcsc valucs arc assumul LO rcaliu:

conditions of Ihc abovc propsilion.

0 0
An arbitnry (c.g nndom) valuc is lakcn for c1 A prcliminary calculation is madc, using Ihc scI~~b.4
Cl1

0 0 2 3
vduc and h c tcmporvy valucs c I 3 = 14; c = 0. The corrcsponding valucs of e l 2 and c8 arc kcpL
15
 42

0 0
Bascd on thcsc preliminary calculations. wc "COITCCL" thc temporary valuc of cI3 by a quantity Ac13 and

0 0 0 0 .
wc also consider ncw valucs cI5+Acl5 for cI5. Thc variation AcI3 I S sclcclcd in such a way thnl for any

0 0 3 3 3 a .
Ac
15 valuc satisfyingAcl 0. the new valuc eg+Acg of eg is qua1 LO -2 with a substantial probability.

8 3
-2 - e 8
.. : If # 0 and -
24.4.7 2
0 and ef mod 16 is not in [ 13,15) rorlsjjls11 thcn for
z
J
CI,

0 2 0 4
any variation Acl5 E O on &t such that c I 5 + AcI5 I: p and 4 p. chc variation

a 3
-2 -e*
-
0
43=- on the cI3 value lwds LO the fotlowing new valucs :
c12

1 1 2 2 2 2 2 2 3 3 8
cI4 + AcI4 = 0 ; c + A c O = O ; c6+Ac - 0 ; c +Ac8=0; c8 +Ac8 = - 2 ,
0 6- 8

Wc pcrformcd a numbcr n of trials of stcp 1. For wch succcssful trial of stcp 1, wc madc a large
0 0
numbcr 3 of trials of c, values at stcp 2. For those e l valucs satislying Ihc conditions of ihc abovc

0 0
proposiuon, we madc a large numbcr n3 of trials of ncw c , valucs
~ such that A C , ~E 0. Thc probability

0 2 2
that Lhc trial of a ncw Ac15 valuc l a d s lo inlermcdiatc variables satisfying h c four cquations c6*, c8=O;

4 4 4 4 4 4
eg=O is basically thc probability bat randomly tried c6 and c5 valucs satisfy c6 = 0 and c5 E 6; the
e
6--0;
-20
ordcr of magniludc of his probabdiiy is thcrcfore 2 .
2 2 4 4
Moreavcr, the probability hat a mcssagc 5 satisfying h c four cquations c6=O; c8=O; c6=O; c -0
8-
lcads

to a full collision g(H1.MZ) = g(HI,%) is basically Lhc probability h a t none of thc ci-3 mod 16 indices

2 2 4 4
occurring in thc calculation of c to cI5 and of eo to c , takes
~ thc value 15. which is closc LO 1/8. So in
0
23
summary appmximatively 2 @a1 cornputillionsof the g runction arc necessary m obtain a mcssagc %

giving a full collision.

 43

23 Implementation details

Thc a b v c attack mcthod was implcmcntcd using a non-optimi;rxxl Pascal program. Thc scarch for a
collision took a k w hours on a SUN3 workstation and lcss lhan an hour on a SPARC worlstalion. W C
provide in anncx thc dcuil of thc intcrmcdiak calculations for two colliding mcssagcs MI% and MI% .
of two 128-bit blocks each.
0 0
Note that for many olhcr V ~ U & W 1 of h c form (eo. ___ ,e15 + k. 6) (k : an intcgcr) of Ihc first 128-bit

block, thc mcssagc MI% lads to the samc hash value as MIMZ thc obscrvcd phcnomenon is in fact a

3 Conclusions

Thc attack dcscribcd in this paper ukcs advanhgc ol thc two lollowing wcakncsscs Of rhc m-
Hashing algorithm :

- thc influcncc of thc krm cc. in the rccurrcncc ci := ci + c.1-1e.1-2 cci-3 + 2' (mod p) on the
+

1-3

2 2
sccunly of thc algorithm is nhcr ncgativc (see for cxamplc the mclhcd to obtain c6 = 0 (or c8 = 0) at

stcp 1 of Scction 2.2).

- as mentioned in Scdon 1.3. thc dirfusion inlroduccd by thc four skps ofh c algorithm quitc
limilcd. In pyticular, thc ITgFouricr m s l o r m acts only on half of thc intcrmcdialc valucs (ew ... ,eI5),

namcly thc 8 valucs eg' c2, ... ,c14.

This suggcsts that quite simplc modifications might rcsult in a substanlial impmvcmcnt Of the
security of lhc FFT-Hashing algorithm.

4 Acknowledgements

The aulors arc grcatcful to Jacques BURGER (SEPTPEM.42 mc dcs Coutures, BP 6243, 14066
CAEN.Francc) for ihc Sparc implcmcntation as wcll as useful discussions.

5 References

C.P. SCHNORR; FFT-Hashing : An Elficicnt Cryptographic Hash Function; July 15. 1991
(This papcr was prcscntcd at thc rump scssion of thc CRYPT091 Conrcrcwc.
S U t a BXbUq A u ~ u s 11-15.1991)
~.

DAEMEN - BOSSELAERS - GOVAERTS - VANDEWALLE : Annwnccmcnt madc a1 IhC

rump scssion of thc ASIACRYiT '91 Confcrcncc, Fujiyoshida. Japan, Novcmber
11-14. 1991)
 WNCX

FIRST UESSAGE U - Hl M2 with SECOND MESSAGE U - Ul H2 with

nl - F9SA 8071 26A 0 440 365E 0 0 Ml - r95A 807A 26A 0 440 365E 0 10

H2 - 1537 5202 3284 358 5D1C 959E 6D68 7590 H2 - 1537 5202 3284 358 5D1C 959E 6D68 7590

View publication stats

HO - 123 4567 09A8 CDEF FEDC BA98 7654 3210 HO - 123 4561 89AB CDEF FEDC BA90 1654 3210
Ul - C95A 807A 26A 0 440 3658 0 0 Ml - F95A 007A 26A 0 440 3656 0 10

s t e p 1: 10000 4567 4F72 CDEF 884C 8A98 D98A 3210 SLep 1: 10000 4567 4F72 CDEF 884C BA98 DJaA 3210
F830 8OlA C628 0 3617 365E 0 0 ~ 8 3 0 8 0 7 ~ F~XE o 3677 3651 o 10

step 2: 0 4569 4f76 lDDl 6CEA F49C 1D89 7D13 step 2 : 0 4S69 4F76 lDDl 6CEA F49C 1DB9 7D13
ADDC 156 5ACE CD52 A692 158A 4626 8808 ADDC 156 SAFE cc52 a692 158s 4526 eel8
s t e p 1: crA9 4569 2466 lDDl 2ClA F49C F3D7 7D13 Step 1: CFh9 4569 2466 JDDl 2FlA F49C F3D7 7D13
8305 156 3057 CD52 5A7 l58A 0 BBOB 8305 156 3057 CD52 5A7 158A 0 8818

s t e p 2: 0 4560 riec 91L1 64FB F6D2 F899 A787 Step 2: 0 4568 Fl8C 91L1 64F8 C6DZ FB99 A787
1DCA CDL2 4508 30C5 8F64 t23C 988A 5B06 7DCA CDE2 4508 38E5 8F61 E23C 9BBA 5Bf6
P
P
H1 - 7DCA CDE2 450e 38E5 8F64 E23C 988A 50E6 HI - JDCA COEZ 4508 3865 8F64 E23C 9B8A 58F6

H1 - 7DCh CDEZ 4508 38ES BP64 E23C 988A 5886 Hi - 7DCA CDE2 1508 38f5 8F64 E23C 988A 50F6

l42 - 1537 5202 3284 358 5D1C 959E 6D6B 75EO H: - 1537 5202 3201 358 5D1C 959E 6D68 75EO

s t e p 1: 10000 CDE2 C5BE 3BE5 3E13 L23C 416A 58E6 step 1: 10000 CDE2 C58E 38E5 3E13 E23C 418A 5BF6
FFOl 5202 9804 358 EFO 959E 0 75EO FFOl 5202 9804 358 EFO 9598 0 75EO
step 2: 0 CDE4 C5C2 17.49 6501 6370 0 2A49 step 2: 0 CDO4 C5C2 17A9 6501 6370 0 2A59
0 5402 F306 99.45 8885 9A6E 38EF 73A9 0 5402 f306 9915 8885 9A6E 30Ef 73A9
Step 1: 6268 CDE4 8879 17A9 L 6CC 6370 C7C2 2A49 s t e p 1: E268 CDE4 8879 17A9 C6CC 6370 C7C2 2h59
rF01 5402 CD5 99A5 37C8 9A6E 7FF2 73A9 FFOl 5402 CD5 99A5 37C8 9A6E 7FF2 73A9
step 2 : 5551 E8tC 4E2O EA99 C62f 988 6 0 9E72 step 2: 5551 E84C 4L20 LA99 C82F 9886 0 9.582
0 M 5 3 5EF5 27D8 9554 995 983F 89Cf 0 A853 5EF5 27D8 9554 995 983F 89Cf

H2 - 0 A853 5EF5 27D8 9554 995 983F 89CF K2 - 0 A853 5EF5 2708 9554 995 983f 89CF

HASHED MESSAGE : 0 A853 SCF5 27136 9554 995 983F 89CF HASHED UCSSAGE : D A853 5EFS 21D0 9554 995 983F 89CF