Questions tagged [md4]

RFC 1320 — the MD4 message-digest algorithm — is a cryptographic hash function with a digest length is 128 bits, developed by Ronald Rivest in 1990.

Filter by
Sorted by
Tagged with
0
votes
0answers
30 views

When looking for collisions of MD4, how does the 'Multi-step Modification' work in the paper of Wang et. al?

In part 4.2 of this paper, the writers introduced a technique called 'Multi-step Modification', here I got some questions. How does the Multi-step Modification ensure that we will not change any ...
0
votes
0answers
29 views

Cryptographically secure PRNG from a hash function [duplicate]

Is it possible to get a secure random number generator from a secure hash function this way First choose a natural number $n$ as seed, then if we are looking to generate random numbers from $0$ to $F$...
5
votes
1answer
53 views

How were the constants chosen in round 2 and 3 in MD4?

Just reading Ron Rivest's explanation of MD4 the hash uses two round constants one $ \text{5A827999}$ on round $2$ and the other $\text{6ED9EBA1}$ on round $3$. I think they are supposed to be hex ...
5
votes
1answer
220 views

Why did MD4 replace MD2?

MD2 was a hash function based on swapping bytes in a state array permutation, much like the RC4 stream cipher, whereas MD4 was a novel construction. MD4 replaced MD2 despite the fact that MD4 is more ...
4
votes
1answer
127 views

Cryptanalysis of MD4 (Wang et al) — how did the authors come up with the collision differential?

Edit: ok, after I re-read the paper a couple of times it is clear that Table 6 is easily derived from Table 5, which describes the collision differential. So the real question is: how did the ...
2
votes
1answer
67 views

The Collision Differential for MD4 - a question on notation (Wang, et al)

In the paper "Cryptanalysis of the Hash Functions MD4 and RIPEMD" the authors introduce the following notation (paragraph 4.1): $\Delta$$H_0$ = 0 $\xrightarrow{(M_,M')}$ $\Delta$$H$ = 0 What exactly ...
2
votes
1answer
168 views

Why does FIPS 180-4 require the final padding block start with a 1?

From FIPS 180-4 § 5.1.1, the padding used for the SHA family of hashes begins with a binary 1, followed by a number of 0s, and finally a 64-bit representation of the message length: Suppose that the ...
3
votes
1answer
250 views

Secret IV MAC with weak hash function

Assume there is a secret-IV (hash-based) MAC scheme, i.e. $MAC_k(m) = H_k(m)$, where $H$ is a hash function, $k$ the secret key that initializes the hash function, and $m$ the message to protect with ...
2
votes
1answer
584 views

Can I use HKDF to improve security of HMAC used with weak hash function?

I am writing a framework which encrypts/decrypts files (or streams, in general) with symmetric key using block cipher (for example, AES). To authenticate encrypted file, I use HMAC, which is ...
1
vote
1answer
128 views

Why the data length is shifted 3-bit in MD4 Java implementation? [closed]

In RFC 1320, It is stated that "A 64-bit representation of b (the length of the message before the padding bits were added) is appended to the result of the previous step. In the unlikely event that b ...
7
votes
1answer
284 views

What's the state of the attack to get the first pre-image on MD4?

What's the state of the attack to get the first pre-image on MD4? Is it still $2^{102}$ as described by Gaëtan Leurent in "MD4 is Not One-Way" ?
11
votes
1answer
1k views

Why does a broken hash function undermine an HMAC?

For instance, what makes MD4 a bad choice for an HMAC? In this case I am asking about MD4 because its less than ideal. I know that a preimage attack can be used to undermine the system, but why? ...