# Why was Davies–Meyer chosen over Miyaguchi–Preneel most of the time?

The only Miyaguchi–Preneel MD hash I know is Whirlpool. I suppose there are likely others.

Why do most MD hashes choose Davies–Meyer?

If anything, Davies–Meyer relies on related-key resistance while Miyaguchi–Preneel relies on chosen-plaintext resistance. The former ought to be far more difficult to achieve.

So I'm curious about the rationale.

Edit:

After some further research all I could find was the fact that Davies-Meyer is more efficient because it allows you to stretch the message block based on how the key schedule of the underlying block cipher works. Whereas Miyaguchi–Preneel forces you have

length(key) = length(message block) = length(output)

and deviating from that while possible (with padding) complicates security. So I guess the question is whether that the only reason? Performance? Flexibility? SHA2 may not be able to have variants (eg: 256, 512) as easily with Miyaguchi-Preneel.

• I don't know the answer, but I do know that Whirlpool uses a AES-like cipher, making the choice of Davies-Meyer with related-key resistance probably a no-go. That's just trying to answer the reverse question though :) – Maarten Bodewes Nov 17 at 13:52
• Note that (in theory) Davies-Meyer allows you to compute the key schedules only depending on the data input and can thus (in theory) be done in parallel with encryption eg the previous block, this could be nice for hardware implementations. – SEJPM Nov 18 at 7:01
• @MaartenBodewes I don't think that's true, because the Whirlpool compression function is more resistant against related-key attacks (it reuses the round function for the key-schedule). – Aleph Nov 18 at 19:06
• @Aleph Yeah, that would probably rule out related key attacks. Hmm. The problem with these why questions is that the reason for choosing one or the other is usually not documented. – Maarten Bodewes Nov 18 at 21:34

Note: in the above table, the block cipher $$E$$ uses its first argument as key.