Please, I'm trying to understand second-preimage attacks on cryptographic hash functions. I understand the definition well: given a message and it's hash, an attacker finds another message which results in the same hash value. What I need is an explanation of a successful attack on a real hash function.

I have read lots of articles (from journals - especially Lecture Notes in Computer Science) on successful second-preimage attacks on some cryptographic hash functions but my mind can't get to grasp it properly.

What I need is a practical example (with explanation please) of a second preimage on MD4 using the attack developed by Wang et al in their paper "The Second Preimage Attack on MD4" (alternate link)

Edit(1): Or, better still, can I have an explained example of a second preimage attack using the attack presented by F. Mendel et al. in the paper A (Second) Preimage Attack on the GOST Hash Function I'm desperately in need of some kind of simple step-by-step practical example of a successful attack.

Edit(2): Going back to the second preimage attack on MD4 based on the paper above, a working example is given (Table 2 on page 9 in the paper). I can leave out trying to understand the transformation from the target message M_0 to the weak message M, what I really need is some kind of step-by-step explanation of how the second-preimage M' was discovered using the method given. Please, I am new to cryptography, so an explanation of this example (or any other for that matter) is what can enable me understand this faster and better.

Thanks in advance.

  • 3
    $\begingroup$ If you ask a specific question about any particular preimage attack, I would love to answer. Explaining an attack from scratch would take the same amount of text as the original paper. $\endgroup$ Feb 14, 2014 at 15:37
  • 2
    $\begingroup$ Hello and welcome to Crypto.SE. As Dmitry points out your question need a huge amount of text to be properly answered. This is why I'm voting to close as too broad at this point. Of course you can edit it to limit the scope and make it more "answerable"; I'll leave it up to you. In the meantime try browsing some other questions with the same tag, and maybe you'll find something useful. I hope this helps. $\endgroup$
    – rath
    Feb 14, 2014 at 17:44
  • 1
    $\begingroup$ I've edited my question by narrowing down the request: all I ask for now is a short (practical) example of a second preimage attack on MD4. Hope this is more "answerable" and less broad. Thank you. $\endgroup$
    – IT_guy
    Feb 25, 2014 at 16:55
  • $\begingroup$ The paper is a second-preimage attack with a restriction: it works for a fraction ($1/2^{56}$) of messages. If your are content with similar restriction to $1/2^{511}$ of messages, you can just use the example in table 2: for any $X$, a second-preimage of $M||X$ (resp. $M'||X$) is $M'||X$ (resp. $M||X$). For the full attack, you choose you own first block $\widehat{M_0}$, follow what the paper prescribes to get $\widehat M$ and $\widehat{M'}$, then proceed as I explained before. Tell us what part of what the paper prescribes you have issue with, that might help re-open the question. $\endgroup$
    – fgrieu
    Feb 25, 2014 at 17:30
  • $\begingroup$ Thanks very much for your help fgrieu. Your comment was really very helpful, I did not get the weak message part, but after re-reading I think have now got it. The thing is I'm a "newbie" in cryptography and that is why I needed some kind of concrete example of a successful attack to help me better understand second preimages. This is the reason why I've shifted from the MD4 I asked previously to GOST, hoping with this my question is easier to answer. $\endgroup$
    – IT_guy
    Feb 27, 2014 at 15:08


Browse other questions tagged or ask your own question.