Re: OT: MD4 encryption

In <barmar-6F5819.15423713032008@xxxxxxxxxxxxxxxxxxxxxx>, Barry Margolin wrote:

<94d5dc49-dd56-4ccd-b5fa-f91b41f6028a@xxxxxxxxxxxxxxxxxxxxxxxxxxxx>,
paintedjazz@xxxxxxxxx wrote:

For many years, I've used MD5 to check file integrity and I've known
for a while that MD2 is apparently used for email authentication but
what is MD4 used for? Or was it also used for file integrity checks
and just replaced by MD5 and is no longer used? Wikipedia did not
seem to answer this. Thanks.

You'd probably be better off asking in sci.crypt.

True.

I googled and took a quick look at RFC 1320 (MD4) and RFC 1321 (MD5).
MD5 was created as a replacement for MD4 -- it's a little slower, but
believed to be more secure.

Yes. Shortly after MD4 was published a number of attacks were demonstrated against parts of it. MD5 is the revision intended to ward off of those attacks.

MD5 is now known to be vulnerable in ways that can lead to meaningful attacks. At the very least SHA1 is recommended where most of us still use MD5. SHA1 isn't without problems either and discussion rages on about what is the best cryptographic hash algorithm out there. There are some who suspect that the problem is fundamentally insurmountable.

-j

--
Jeffrey Goldberg http://www.goldmark.org/jeff/
I rarely read top-posted, over-quoting or HTML postings.
http://improve-usenet.org/
.

Relevant Pages

  • Re: This Weeks Finds in Mathematical Physics (Week 226)
    ... Schneier credits Rivest as the designer of MD4, saying Bert den Boer and Antoon Bosselaears successfully crpytanalysed the last of the algorithms three rounds, while Ralph Merkle successfully attacked the first two rounds. ... Schneier credits Rivest as strengthening MD4 with the result being MD5. ...
    (sci.physics.research)
  • Re: Slow but secure has function for small data
    ... the current attacks on the SHA-series are ... irrelevant to HMAC provided the key itself is unknown (page 4 ... for MD4 and MD5, so I would be cautious about Joseph's proposal (at ... MD4 and MD5 are no PRFs anymore? ...
    (sci.crypt)
  • Re: compare-by-hash (was Re: sharing /etc/passwd)
    ... No, md4 and md5 are broken, in the sense that it's known how to ... das@VARK:~> hexdump md4c_1 ... The md5 data comes from the page ...
    (FreeBSD-Security)
  • Re: Slow but secure has function for small data
    ... Of course they don't contradict each other. ... The assumption that MD4 or MD5 behave like a PRF is not true. ...
    (sci.crypt)
  • Re: Crypto Mini-FAQ
    ... Here's one thing Hans Dobbertin wrote about MD5: ... "would be unwise to assume that the attack could not be ... It is instructive to read the history of MD4. ...
    (sci.crypt)