Hashed hash

I'm planning on implementing the "cryptographic protection of databases" 
on page 61 of Schneier, to create a directory of a professional 
organization that would be useless to telemarketers.

There's a problem, though: a brute-force attack is agonizingly easy. If 
the hash algorithm runs at the same speed as DES, then an MC68040 could 
break all eight-letter last names in about three months. Only those who 
have twelve-letter last names would have even the security of DES against 
brute-force, and all this goes out the window if the attacker has any 
brains at all and uses the "telephone-book" attack Bruce mentions.

So, my question: for any of the popular hash algorithms H(m), is it known if 
there is or is not an algorithm I(m) such that I(m)=H(H(m))? Are the hash 
algorithms groups or not?

If not, then I can hash the name field as many times as I like for as much
of a strength v speed compromise as I want. If they are groups, then I
either have to figure out some other method of slowing things down--and I
haven't yet thought of anything that isn't either trivial or security
through obscurity--or decide if I can live with the fact that it's still
about as hard to get the information by a cryptographic attack as by
scanning in the printed book. 

Of course, should the electronic version be much more secure, then perhaps 
I can talk the organization into stopping printed publication, and it 
would be useful to organizations which haven't yet published their 
membership lists over fears of abuse.

b&

--
Ben.Goren@asu.edu, Arizona State University School of Music
 net.proselytizing (write for info): Protect your privacy; oppose Clipper.
 Voice concern over proposed Internet pricing schemes. Stamp out spamming.
 Finger ben@tux.music.asu.edu for PGP 2.3a public key.

On Sat, 16 Jul 1994, Ben Goren wrote:
> So, my question: for any of the popular hash algorithms H(m), is it known if 
> there is or is not an algorithm I(m) such that I(m)=H(H(m))? Are the hash 
> algorithms groups or not?
I too would be interested in this, but would also wory about the hash 
functions "converging" to one value.  Unless the function G(i) is one on 
one, and not a group, this not good.  [G(i): G=H(m;i) i=H(m)] You could 
loose information in in the G phase of hashing, and shoot yourself in the 
foot.  What is wrong with the folowing two stratigies.:

1)
let I(key,block) be Idea(key, block)
    N be the number of iterations.
 
and Si be a non-strong, simple sequence, like from a LCG.
do I(S1,I(s2,i(s3,..........,i(sN,m);
for however many times, then hash it.

2) 
use a salt value, n. with n%N not equal to 0;
do 
 {
  m=i(s1,previous m)
 and 
  n=i(n,previous n)
  
  
 } untill (n%N=0)

Number 2 has the added bonus of working with true random numbers for n, 
so if you wanted to inclose the value of n in some encryption you have no 
plaintext.

If you keep this to 8 bits or so, you could use feal-4 instead of idea:-)

I asked a similar question about hash functions and have recieved no 
replies.

Roger.