# Is there a feasible preimage attack for any hash function (no matter how deprecated) today?

Has there ever been a hash function that was actually used in the field, no matter how long ago, for which there is now a feasible preimage attack?

All hashes that are nowadays considered 'broken' (such as MD5 and MD4 and older, and to some extent also SHA-1) are only susceptible to collision attacks, i.e. generating two arbitrary chunks of data with the same hash.

I'm wondering if a successful preimage attack has ever been found for any hash algorithm? And I mean either kind of preimage attack:

• Regular, i.e. given a hash output H, being able to generate some data X so hash(X) = H
• Secondary, i.e. given data X, being able to generate some other data Y so hash(X)=hash(Y)

And with 'feasible' I mean it can be done on a reasonably powerful cluster of fast computers (with fast GPUs) within reasonable time (e.g. 6 months).

• My interpretation of the question is that it is only asking about hash functions which where intended to be resistant to preimage attacks when they were designed. As such CRC would be outside the scope of the question but MD2 would be an answer. I wonder if the memory usage of $2^{73}$ for that attack could be improved, which would make the answer a clear yes. – kasperd Feb 5 '19 at 10:29
• I'm actually surprised to learn that even with something as old and insecure and broken as MD2, it's still extremely impractical (close to impossible) to do a preimage attack. $2^{73}$ complexity is actually still a lot nowadays in most situations (considering that a really fast setup would perform, what.. several hundreds of billions attempts per sec?) and the $2^{73}$ memory requirement makes it virtually impossible even today. – RocketNuts Feb 5 '19 at 14:34
• @kelalaka It's not even close. The memory requirement is $2^{73}$ blocks, with each block being 512 bytes. – forest Feb 6 '19 at 3:35