Does a (first-)preimage attack require the target hash actually exist in the function's output space? I'm wondering which of these would be correct:

1. Given h where f(m) = h, find any m' such that f(m') = h.

2. Given h, find any m such that f(m) = h.

The former guarantees that a message that hashes to h exists, even if it has to mean that m = m'.

@forest am I reading this right as actually asking for "what is the most widely accepted definition of pre-image resistance"?

@forest it appears that both definitions are possible

eprint.iacr.org/2004/035.pdf section 3.1 of this pdf got you covered with the definitions