Is it OK to make large changes in an off-topic question one did not ask, in an attempt to salvage it?
Motivating context: this recent question asked for the preimage resistance of a custom hash function, exposed as a piece of C code (with link to source of a full test program and some test vectors). It was understandably closed as off-topic on the grounds that
Requests for analyzing ciphertext or reviewing full cryptographic designs are off-topic, as the results are rarely useful to anyone else and/or would be too long for this site.
I would like to fix the question, because I find that
- The design has the virtue of being extremely simple, close to minimalist for a cryptographic hash function with arbitrary input and output size and a state of 128 trits. That makes discussion possible.
- The design can be described in an existing academic framework (iterated hash function with message block reduced to a single bit; at least Merkle–Damgård sans length strengthening and alternate output production, perhaps even better as a sponge with 1-bit input/output per iteration).
- The only immediately clear flaw (biased output) is non-devastating, easily fixable, and a non-issue w.r.t. preimage resistance or collision-resistance.
- Another unusual characteristic (some state entropy loss at each message bit, also easily fixable) seems worth a discussion about if this in an exploitable weakness.
My fixes would incorporate into the question the description part of my answer. I would ask about the security of some generic hash construct restricted to 1 bit input/output processed by hash round, w.r.t. standard hash security criteria (RO security, collision resistance, first/second preimage resistance); and how the entropy loss in the message injection is affecting that.
I also wonder what to do about the code:
- remove it
- improve it for unbiased output
- change it for no entropy loss at each input bit (not exclusive from 2)
- make it simpler only where that can be done without changing the result
- separate message processing and output production (not exclusive from 2..4)
- leave it as is.