MD4 - Revision history

Fmendel: /* Preimage Attacks */

2008-11-10T09:32:45Z

‎Preimage Attacks

Fmendel: /* Specification */

2008-03-12T07:47:01Z

‎Specification

Fmendel: /* Collision Attacks */

2008-03-11T13:16:19Z

‎Collision Attacks

Fmendel: /* Collision Attacks */

2008-03-11T12:53:51Z

‎Collision Attacks

Fmendel: /* Collision Attacks */

2008-03-11T12:52:45Z

‎Collision Attacks

Crechberger: /* Collision Attacks */

2008-03-11T10:28:09Z

‎Collision Attacks

Tnad: /* Collision Attacks */

2008-03-11T10:16:31Z

‎Collision Attacks

Tnad: /* Collision Attacks */

2008-03-11T10:16:19Z

‎Collision Attacks

Tnad: /* Collision Attacks */

2008-03-11T10:12:20Z

‎Collision Attacks

Mlamberger: /* Collision Attacks */

2008-03-11T10:05:19Z

‎Collision Attacks

← Older revision		Revision as of 09:32, 10 November 2008
Line 233:		Line 233:

	=== Preimage Attacks ===		=== Preimage Attacks ===
		+
		+	<bibtex>
		+	@inproceedings{fseLeurent08,
		+	author = {Ga{\"e}tan Leurent},
		+	title = {MD4 is Not One-Way},
		+	booktitle = {FSE},
		+	year = {2008},
		+	pages = {412-428},
		+	abstract = {MD4 is a hash function introduced by Rivest in 1990. It is still used in some contexts, and the most commonly used hash functions (MD5, SHA-1, SHA-2) are based on the design principles of MD4. MD4 has been extensively studied and very efficient collision attacks are known, but it is still believed to be a one-way function. In this paper we show a partial pseudo-preimage attack on the compression function of MD4, using some ideas from previous cryptanalysis of MD4. We can choose 64 bits of the output for the cost of 2^32 compression function computations (the remaining bits are randomly chosen by the preimage algorithm). This gives a preimage attack on the compression function of MD4 with complexity 2^96, and we extend it to an attack on the full MD4 with complexity 2^102. As far as we know this is the first preimage attack on a member of the MD4 family. },
		+	url = {http://dx.doi.org/10.1007/978-3-540-71039-4_26},
		+	editor = {Kaisa Nyberg},
		+	publisher = {Springer},
		+	series = {LNCS},
		+	volume = {5086},
		+	isbn = {978-3-540-71038-7},
		+	}
		+	</bibtex>

	<bibtex>		<bibtex>

@@ Line 4: / Line 4: @@
 * max. message length: < 2<sup>64</sup> bits
 * compression function: 512-bit message block, 128-bit chaining variable
-* Specification:
+* Specification: [http://www.ietf.org/rfc/rfc1320.txt RFC1320]
 <bibtex>
 @inproceedings{cryptoRivest90,

@@ Line 39: / Line 39: @@
 === Collision Attacks ===
 <bibtex>
 @inproceedings{fseSasakiWOK07,

@@ Line 65: / Line 65: @@
+}
 </bibtex>
 <bibtex>
 @inproceedings{fseLeurent07,
@@ Line 108: / Line 109: @@
+}
 </bibtex>
 <bibtex>

@@ Line 91: / Line 91: @@
+}
 </bibtex>
 <bibtex>

@@ Line 172: / Line 172: @@
    url       = {http://dx.doi.org/10.1007/3-540-60590-8_22}
+}
 </bibtex>

← Older revision		Revision as of 10:12, 11 March 2008
Line 39:		Line 39:

	=== Collision Attacks ===		=== Collision Attacks ===
		+	<bibtex>
		+	@inproceedings{fseLeurent07,
		+	author = {Gaëtan Leurent},
		+	title = {Message Freedom in MD4 and MD5 Collisions: Application to APOP},
		+	pages = {309-328},
		+	url = {http://dx.doi.org/10.1007/978-3-540-74619-5_20},
		+	editor = {Alex Biryukov},
		+	booktitle = {FSE},
		+	publisher = {Springer},
		+	series = {LNCS},
		+	volume = {4593},
		+	year = {2007},
		+	isbn = {978-3-540-74617-1},
		+	abstract = {In Wang’s attack, message modifications allow to
		+	deterministically satisfy certain sufficient conditions to find
		+	collisions efficiently. Unfortunately, message modifications
		+	significantly change the messages and one has little control
		+	over the colliding blocks. In this paper, we show how to choose
		+	small parts of the colliding messages. Consequently, we break a
		+	security countermeasure proposed by Szydlo and Yin at CT-RSA ’06,
		+	where a fixed padding is added at the end of each block. Furthermore,
		+	we also apply this technique to recover part of the passwords in the
		+	Authentication Protocol of the Post Office Protocol (POP). This shows
		+	that collision attacks can be used to attack real protocols, which means that finding collisions is a real threat.}
		+	}
		+	</bibtex>

	<bibtex>		<bibtex>

← Older revision		Revision as of 10:05, 11 March 2008
Line 39:		Line 39:

	=== Collision Attacks ===		=== Collision Attacks ===
		+
		+	<bibtex>
		+	@inproceedings{eurocryptWangLFCY05,
		+	author = {Xiaoyun Wang and Xuejia Lai and Dengguo Feng and Hui Chen and Xiuyuan Yu},
		+	title = {Cryptanalysis of the Hash Functions MD4 and RIPEMD},
		+	booktitle = {EUROCRYPT},
		+	year = {2005},
		+	pages = {1-18},
		+	abstract = {MD4 is a hash function developed by Rivest in 1990. It serves as the basis for most of the dedicated hash functions such as MD5, SHAx, RIPEMD, and HAVAL. In 1996, Dobbertin showed how to find collisions of MD4 with complexity equivalent to 220 MD4 hash computations. In this paper, we present a new attack on MD4 which can find a collision with probability 2–2 to 2–6, and the complexity of finding a collision doesnrsquot exceed 28 MD4 hash operations. Built upon the collision search attack, we present a chosen-message pre-image attack on MD4 with complexity below 28. Furthermore, we show that for a weak message, we can find another message that produces the same hash value. The complexity is only a single MD4 computation, and a random message is a weak message with probability 2–122. The attack on MD4 can be directly applied to RIPEMD which has two parallel copies of MD4, and the complexity of finding a collision is about 218 RIPEMD hash operations.},
		+	editor = {Ronald Cramer},
		+	volume = {3494},
		+	series = {LNCS},
		+	publisher = {Springer},
		+	isbn = {3-540-25910-4},
		+	url = {http://dx.doi.org/10.1007/11426639_1},
		+	}
		+	</bibtex>

	<bibtex>		<bibtex>