Edit: ok, after I re-read the paper a couple of times it is clear that Table 6 is easily derived from Table 5, which describes the collision differential. So the real question is: how did the authors come up with the collision differential?

Original question:

The paper Cryptanalysis of the Hash Functions MD4 and RIPEMD describes a set of sufficient conditions for collisions of MD4 (Table 6 in the paper). The authors explain how to verify these conditions, but there is no info about how they got them in the first place. I'm curious, what could be a possible procedure?


1 Answer 1


I've found the following tweet:

[...] all the papers I've read say that she found the right difference patterns by "intuition"


I'll happily accept another, more specific answer!


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.