Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

What's the state of the attack to get the first pre-image on MD4?

Is it still $2^{102}$ as described by Gaëtan Leurent in "MD4 is Not One-Way" ?

share|improve this question
There are references to improved attacks in this paper by Jinmin Zhong and Xuejia Lai from 2010. – Henrick Hellström Apr 9 '13 at 17:56

The latest I know about is indeed "MD4 is Not One-Way." by Gaëtan Leurent (PDF) FSE 2008. Some of the more interesting and more recent publications to check on are "Advanced Meet-in-the-Middle Preimage Attacks: First Results on Full Tiger, and Improved Results on MD4 and SHA-2", Jian Guo/San Ling/Christian Rechberger/Huaxiong Wang, 2010 (PDF) and the paper Henrick Hellström mentioned in his comment. I don't think you'll find any more recent and/or note-worthy discoveries.

In 2011 there was RFC 6150 ( which stated that MD4 aka RFC 1320 ( is "historic"; meaning: "obsolete". I guess, due to the now "historic" status of MD4, there won't be too much interest to expand further on the issue.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.