Fix $N \in \mathbb{N}$. Suppose we throw $N$ numbered balls into $N$ numbered urns, so that for each $b \in \{1,\ldots,N\}$, ball $b$ lands in urn $j$ with equal probability $1/N$. Choose a number $c \in \{1,\ldots, N\}$ uniformly at random. Then choose further $b_1, \ldots, b_r \in \{1,\ldots, N\}$, so that $b_i$ is chosen uniformly at random from $\{1,\ldots,N\} \backslash \{b_1,\ldots,b_{i-1}\}$, stopping as soon as ball $b_r$ and ball $c$ are in the same urn.

What is the expected value of $r$?

I can get some fairly crude upper and lower bounds. I would like an asymptotically correct answer.

One possible approach to the problem is to approximate the number of balls in urn $j$ by a Poisson random variable with mean $1$. So I would also be interested in the answer to the following question.

Let $B_1,\ldots, B_N$ be independent Poisson random variables with mean $1$. What is the expected value of $r$ if we start with $B_j$ balls in urn $j$, for each $j$?

**Motivation.** Suppose $\{1,\ldots, N\}$ are permitted passwords, and that passwords are hashed using an idealized hash function $h : \{1,\ldots, N\}\rightarrow \{1,\ldots, N\}$, constructed so that each $h(b)$ is chosen uniformly at random from $\{1,\ldots, N\}$. Then $r$ is the expected number of hashes we must compute to obtain a password $b \in \{1,\ldots,N\}$ with the same hash as a randomly chosen $c \in \{1,\ldots, N\}$.

Very possibly the answer to my question is out there in the cryptography literature, but if so, I'm finding it hard to find among all the papers dealing with the birthday paradox or other types of hash collision.