Cryptanalysis of MD2

Journal of Cryptology

Volumn 23, Issue 1, 2010, Pages 72-90

  Knudsen, Lars R ^a   Mathiassen, John Erik ^b   Muller, Frédéric ^c   Thomsen, Søren S ^a  

^a TECHNICAL UNIVERSITY OF DENMARK   (Denmark)

^b Avenir AS   (Norway)

^c HSBC Halbis Partners   (France)

Author keywords

Collision attack; Cryptographic hash function; MD2; Preimage attack

Indexed keywords

BRUTE-FORCE ATTACK; COLLISION ATTACK; CRYPTANALYTIC ATTACKS; CRYPTOGRAPHIC HASH FUNCTIONS; PREIMAGE ATTACK;

HASH FUNCTIONS;

COMPUTER CRIME;

EID: 74349131341     PISSN: 09332790     EISSN: 14321378     Source Type: Journal    
DOI: 10.1007/s00145-009-9054-1     Document Type: Article

References (22)

1. R.P. Brent 1980 An improved Monte Carlo factorization algorithm BIT 20 2 176 184 0439.65001 10.1007/BF01933190 583032
2. I. Damgård, A design principle for hash functions, in Advances in Cryptology-CRYPTO '89, Proceedings, ed. by G. Brassard. Lecture Notes in Computer Science, vol. 435 (Springer, Berlin, 1990), pp. 416-427
3. R.W. Floyd 1967 Nondeterministic algorithms J. Assoc. Comput. Mach. 14 4 636 644 0153.47006
4. A. Joux, Multicollisions in iterated hash functions. Application to cascaded constructions, in Advances in Cryptology-CRYPTO 2004, Proceedings, ed. by M.K. Franklin. Lecture Notes in Computer Science, vol. 3152 (Springer, Berlin, 2004), pp. 306-316
5. B.S. Kaliski Jr., The MD2 Message-Digest Algorithm, April 1992. Network Working Group, Request for Comments: 1319
6. L.R. Knudsen, J.E. Mathiassen, Preimage and collision attacks on MD2, in Fast Software Encryption 2005, Proceedings, eds. by H. Gilbert, H. Handschuh. Lecture Notes in Computer Science, vol. 3557 (Springer, Berlin, 2005), pp. 255-267
7. X. Lai, J.L. Massey, Hash functions based on block ciphers, in Advances in Cryptology-EUROCRYPT '92, Proceedings, ed. by R.A. Rueppel. Lecture Notes in Computer Science, vol. 658 (Springer, Berlin, 1993), pp. 55-70
8. F. Mendel, V. Rijmen, Weaknesses in the HAS-V compression function, in International Conference on Information Security and Cryptology (ICISC) 2007, Proceedings, ed. by K.-H. Nam, G. Rhee. Lecture Notes in Computer Science, vol. 4817 (Springer, Berlin, 2007), pp. 335-345
9. F. Mendel, N. Pramstaller, C. Rechberger, A (second) preimage attack on the GOST hash function, in Fast Software Encryption 2008, Proceedings, ed. by K. Nyberg. Lecture Notes in Computer Science, vol. 5086 (Springer, Berlin, 2008), pp. 224-234
10. F. Mendel, N. Pramstaller, C. Rechberger, M. Kontak, J. Szmidt, Cryptanalysis of the GOST hash function, in Advances in Cryptology-CRYPTO 2008, Proceedings, ed. by D. Wagner. Lecture Notes in Computer Science, vol. 5157 (Springer, Berlin, 2008), pp. 162-178
11. R.C. Merkle, One way hash functions and DES, in Advances in Cryptology-CRYPTO '89, Proceedings, ed. by G. Brassard. Lecture Notes in Computer Science, vol. 435 (Springer, Berlin, 1990), pp. 428-446
12. F. Muller, The MD2 hash function is not one-way, in Advances in Cryptology-ASIACRYPT 2004, Proceedings, ed. by P.J. Lee. Lecture Notes in Computer Science, vol. 3329 (Springer, Berlin, 2004), pp. 214-229
13. National Institute of Standards and Technology. FIPS PUB 180-2, Secure Hash Standard, 1 August 2002
14. G. Nivasch 2004 Cycle detection using a stack Inf. Process. Lett. 90 3 135 140 05581118 10.1016/j.ipl.2004.01.016 2052030
15. B. Preneel, Analysis and design of cryptographic hash functions. PhD thesis, Katholieke Universiteit Leuven, January 1993
16. J.-J. Quisquater, J.-P. Delescaille, How easy is collision search. New results and applications to DES, in Advances in Cryptology-CRYPTO '89, Proceedings, ed. by G. Brassard. Lecture Notes in Computer Science, vol. 435 (Springer, Berlin, 1990), pp. 408-413
17. R.L. Rivest, The MD4 message digest algorithm, in Advances in Cryptology-CRYPTO '90, Proceedings, eds. by A. Menezes, S.A. Vanstone. Lecture Notes in Computer Science, vol. 537 (Springer, Berlin, 1991), pp. 303-311
18. R.L. Rivest, The MD5 Message-Digest Algorithm, April 1992. Network Working Group, Request For Comments: 1321
19. N. Rogier P. Chauvaud 1997 MD2 is not secure without the checksum byte Des. Codes Cryptogr. 12 3 245 251 0880.94010 10.1023/A:1008220711840 1473033
20. RSA Laboratories, PKCS #1: RSA Cryptography Standard (Version 2.1, June 14, 2002). Available: http://www.rsa.com/rsalabs/node.asp?id=2125 [2009/1/28]
21. P.C. van Oorschot M.J. Wiener 1999 Parallel collision search with cryptanalytic applications J. Cryptol. 12 1 1 28 0992.94028 10.1007/PL00003816
22. Verisign, Inc. Status Responder Certificate. Class 3 Public Primary Certification Authority. Serial number: 70:BA:E4:1D:10:D9:29:34:B6:38:CA:7B:03: CC:BA:BF. Issued 1996/01/29, expires 2028/08/02. http://www.verisign.com/ repository/root.html#c3pca [2009/08/17]