linear cryptanalysis of hash function I have studied linear cryptanalysis for block ciphers, but i did not understand how it works on hash functions. Can you give me an explanation of this attack on hash functions?
The use of linear cryptanalysis for unkeyed hash functions seems to data back to the article (available here) below 

Handschuh H, Knudsen LR, and Robshaw MJ, Analysis
of SHA-1 in encryption mode, published in the Cryptographers' Track-RSA Conference, Naccache, D. (Ed.), LNCS 2020, Springer-Verlag, Berlin, pp.70-83, 2001

The authors state:


  SHA was never defined to be used for encryption. However, the compression
  function can be used for encryption. Each of the 80 steps of SHA-1 (divided into
  four rounds, each of 20 steps) are invertible in the five A, B, C, D, and E variables
  used for compression. Therefore, if one inserts a secret key in the message and a
  plaintext as the initial value, one gets an invertible function from the compression function by simply skipping the last forward addition with the input. 
  This is the encryption mode of SHA considered in this report. The resulting block cipher is named SHACAL and has been submitted to NESSIE by Naccache and the first
  author.