If we define a hash function or compression function h that

Question

If we define a hash function (or compression function) h that will hash an n-bit binary string to an m-bit binary string, we can view h as a function from Z₂ to Z_2m. It is tempting to define h using integer operations modulo 2^m. We show in this exercise that some simple constructions of this type are insecure and should therefore be avoided.

a. Suppose that u = m > 1 and h : Z₂ m → Z_2m is defined as

h(x) = x² + ax + b mod 2^m.

Prove that it is easy to solve Second Preimage for any x Z^2m without having to solve a quadratic equation.