MD2 - Revision history

Fmendel: /* Specification */

2008-03-12T07:53:53Z

‎Specification

Crechberger at 19:55, 10 March 2008

2008-03-10T19:55:00Z

Crechberger at 19:40, 10 March 2008

2008-03-10T19:40:12Z

Tnad: /* Collision Attacks */

2008-03-10T18:55:57Z

‎Collision Attacks

Tnad: /* Collision Attacks */

2008-03-10T18:53:43Z

‎Collision Attacks

Tnad: /* Collision Attacks */

2008-03-10T18:52:35Z

‎Collision Attacks

Fmendel: /* Preimage Attacks */

2008-03-10T16:17:14Z

‎Preimage Attacks

Fmendel at 16:08, 10 March 2008

2008-03-10T16:08:55Z

Fmendel: /* Others */

2008-03-10T16:06:43Z

‎Others

Fmendel at 16:06, 10 March 2008

2008-03-10T16:06:12Z

New page

== Specification ==



== Cryptanalysis ==

=== Best Known Results ===

----

=== Generic Attacks ===
* [[GenericAttacksMerkleDamgaard| Generic Attacks on the Merkle-Damgaard Construction ]]

----

=== Collision Attacks ===

----

=== Second Preimage Attacks ===

----

=== Preimage Attacks ===

----

=== Others ===

@@ Line 16: / Line 16: @@
 === Generic Attacks ===
-* MD2 is not a design follwing the Merkle-Damgaard construction principle. [[GenericAttacksMerkleDamgaard| Generic Attacks on the Merkle-Damgaard Construction ]]
+* MD2 is not a design follwing the Merkle-Damgaard construction principle. [[GenericAttacksHash| Generic Attacks on Hash Functions]]
 ----

@@ Line 34: / Line 34: @@
    year      = {2005},
    isbn      = {3-540-26541-4},
-   abstract  = {This paper contains several attacks on the hash function MD2 which has a hash code size of 128 bits. At Asiacrypt 2004 Muller presents the first known preimage attack on MD2. The time complexity of the attack is about 2^104 and the preimages consist always of 128 blocks. We present a preimage attack of complexity about 2^97 with the further advantage that the preimages are of variable lengths. Moreover we are always able to find many preimages for one given hash value. Also we introduce many new collisions for the MD2 compression function, which lead to the first known (pseudo) collisions for the full MD2 (including the checksum), but where the initial values differ. Finally we present a pseudo preimage attack of complexity 2^95 but where the preimages can have any desired lengths.},
+   abstract  = {This paper contains several attacks on the hash function MD2 which has a hash code size of 128 bits.
+}
 </bibtex>

@@ Line 34: / Line 34: @@
    year      = {2005},
    isbn      = {3-540-26541-4},
-   abstract  = {This paper contains several attacks on the hash function MD2 which has a hash code size of 128 bits. At Asiacrypt 2004 Muller presents the first known preimage attack on MD2. The time complexity of the attack is about 2104 and the preimages consist always of 128 blocks. We present a preimage attack of complexity about 297 with the further advantage that the preimages are of variable lengths. Moreover we are always able to find many preimages for one given hash value. Also we introduce many new collisions for the MD2 compression function, which lead to the first known (pseudo) collisions for the full MD2 (including the checksum), but where the initial values differ. Finally we present a pseudo preimage attack of complexity 295 but where the preimages can have any desired lengths.},
+   abstract  = {This paper contains several attacks on the hash function MD2 which has a hash code size of 128 bits. At Asiacrypt 2004 Muller presents the first known preimage attack on MD2. The time complexity of the attack is about 2^104 and the preimages consist always of 128 blocks. We present a preimage attack of complexity about 2^97 with the further advantage that the preimages are of variable lengths. Moreover we are always able to find many preimages for one given hash value. Also we introduce many new collisions for the MD2 compression function, which lead to the first known (pseudo) collisions for the full MD2 (including the checksum), but where the initial values differ. Finally we present a pseudo preimage attack of complexity 2^95 but where the preimages can have any desired lengths.},
+}
 </bibtex>

← Older revision		Revision as of 18:52, 10 March 2008
Line 21:		Line 21:

	=== Collision Attacks ===		=== Collision Attacks ===
		+	<bibtex>
		+	@inproceedings{fseKnudsenM05,
		+	author = {Lars R. Knudsen and John Erik Mathiassen},
		+	title = {Preimage and Collision Attacks on MD2},
		+	pages = {255-267},
		+	url = {http://dx.doi.org/10.1007/11502760_17},
		+	editor = {Henri Gilbert and Helena Handschuh},
		+	booktitle = {FSE},
		+	publisher = {Springer},
		+	series = {LNCS},
		+	volume = {3557},
		+	year = {2005},
		+	isbn = {3-540-26541-4},
		+	abstract = {This paper contains several attacks on the hash function MD2 which has a hash code size of 128 bits. At Asiacrypt 2004 Muller presents the first known preimage attack on MD2. The time complexity of the attack is about 2104 and the preimages consist always of 128 blocks. We present a preimage attack of complexity about 297 with the further advantage that the preimages are of variable lengths. Moreover we are always able to find many preimages for one given hash value. Also we introduce many new collisions for the MD2 compression function, which lead to the first known (pseudo) collisions for the full MD2 (including the checksum), but where the initial values differ. Finally we present a pseudo preimage attack of complexity 295 but where the preimages can have any desired lengths.},
		+	}
		+	</bibtex>

	----		----

← Older revision		Revision as of 16:17, 10 March 2008
Line 30:		Line 30:
	=== Preimage Attacks ===		=== Preimage Attacks ===

		+	<bibtex>
		+	@inproceedings{asiacryptMuller04,
		+	author = {Fr{\'e}d{\'e}ric Muller},
		+	title = {The MD2 Hash Function Is Not One-Way},
		+	pages = {214-229},
		+	url = {http://springerlink.metapress.com/openurl.asp?genre=article{\&}issn=0302-9743{\&}volume=3329{\&}spage=214},
		+	editor = {Pil Joong Lee},
		+	booktitle = {ASIACRYPT},
		+	publisher = {Springer},
		+	series = {LNCS},
		+	volume = {3329},
		+	year = {2004},
		+	isbn = {3-540-23975-8},
		+	abstract = {MD2 is an early hash function developed by Ron Rivest for RSA Security, that produces message digests of 128 bits. In this paper, we show that MD2 does not reach the ideal security level of $2^128$. We describe preimage attacks against the underlying compression function, the best of which has complexity of $2^73$. As a result, the full MD2 hash can be attacked in preimage with complexity of $2^104$.},
		+	}
		+	</bibtex>

	----		----

@@ Line 1: / Line 1: @@
 == Specification ==
 <!--
 * max. message length: < 2<sup>64</sup> bits
 -->
 == Cryptanalysis ==

@@ Line 38: / Line 38: @@
 @article{dccRogierC97,
    author    = {N. Rogier and Pascal Chauvaud},
-   title     = {{MD2 Is not Secure without the Checksum Byte}},
+   title     = {MD2 Is not Secure without the Checksum Byte},
    journal   = {Des. Codes Cryptography},
    volume    = {12},

← Older revision		Revision as of 16:06, 10 March 2008
Line 34:		Line 34:

	=== Others ===		=== Others ===
		+
		+	<bibtex>
		+	@article{dccRogierC97,
		+	author = {N. Rogier and Pascal Chauvaud},
		+	title = {{MD2 Is not Secure without the Checksum Byte}},
		+	journal = {Des. Codes Cryptography},
		+	volume = {12},
		+	number = {3},
		+	year = {1997},
		+	pages = {245-251},
		+	url = {http://dx.doi.org/10.1023/A:1008220711840},
		+	abstract = {In 1989, Ron Rivest introduced the MD2 Message Digest Algorithm which takes as input a message of arbitrary length and produces as output a 128-bit message digest, by appending some redundancy to the message and then iteratively applying a 32 bytes to 16 bytes compression function. MD2 Message Digest Algorithm is one of the most frequently used hashing function with MD4, MD5, SHA, SHA-1. Some attacks against MD4 and MD5 have been presented by Dobbertin. Up to now, no attack against MD2 has been presented. This function has been updated in 1993 in the RFC 1423 document. It was conjectured that the number of operations needed to get two messages having the same message digest is on the order of 2^64 (using the birthday paradox), and that the complexity of inverting the hash function is on the order of 2^128 operations. No attack against this function has been published so far. In this paper, we propose a low complexity method to find collisions for the compression function of MD2. The easiness to find these collisions could imply that the first conjecture is false if these collisions can be used to make global collisions for MD2.},
		+	}
		+	</bibtex>