Second pre-image resistance means that, given an input and its digest, an attacker should not be able to find a different input producing the same digest. The input is fixed; the attacker searches for its substitute. section 2.2 section 2.7
Keep these nearby distinctions in mind:
- Pre-image resistance hides the original input when only its digest is known. section 2.2
- Second pre-image resistance starts with one known input and prevents finding a different input with the same digest. section 2.2
- Collision resistance prevents an attacker from choosing both different inputs, making it a different threat model. section 2.2
Checking a downloaded file
A website publishes a file and its SHA-256 digest. Running `openssl dgst -sha256 downloaded_file` lets you compare the local digest with the published value. If the digest is trustworthy, second pre-image resistance makes substituting a different file with that same value computationally infeasible. The digest itself is not automatically trustworthy: someone who can replace the webpage can replace the published digest too. section 2.1
When encoding breaks the protection
Hashing transaction fields by simple concatenation can make different transactions produce identical byte strings. For example, `Alice`, `Bob`, `100`, `15` and `Alice`, `Bob`, `1001`, `5` produce the same SHA3-256 digest under the shown encoding. Prefixing each field with its length, or using TupleHash, makes the serialization unambiguous before hashing. section 2.5.4
Short digests are dangerous
A short authenticated string can make a second pre-image search practical. With a 20-bit truncated hash, an attacker may need only about 2^20 computations to generate a public key yielding a chosen matching value. A commitment that fixes the first public key before the other key is revealed removes the attacker’s ability to choose both sides freely. section 11.3.3
