| 词条 | MD4 |
| 释义 |
| name = MD4 | image = | caption = | designers = Ronald Rivest | publish date = October 1990[1] | series = MD2, MD4, MD5, MD6 | derived from = | derived to = | related to = | certification = | digest size = 128 bits | block size = 512 bits | structure = | rounds = 3 | cryptanalysis = A collision attack published in 2007 can find collisions for full MD4 in less than 2 hash operations.[2] }} The MD4 Message-Digest Algorithm is a cryptographic hash function developed by Ronald Rivest in 1990.[3] The digest length is 128 bits. The algorithm has influenced later designs, such as the MD5, SHA-1 and RIPEMD algorithms. The initialism "MD" stands for "Message Digest." The security of MD4 has been severely compromised. The first full collision attack against MD4 was published in 1995 and several newer attacks have been published since then. As of 2007, an attack can generate collisions in less than 2 MD4 hash operations.[2] A theoretical preimage attack also exists. A variant of MD4 is used in the ed2k URI scheme to provide a unique identifier for a file in the popular eDonkey2000 / eMule P2P networks. MD4 was also used by the rsync protocol (prior to version 3.0.0.) MD4 is used to compute NTLM password-derived key digests on Microsoft Windows NT, XP, Vista, 7, 8, and 10.[4] SecurityWeaknesses in MD4 were demonstrated by Den Boer and Bosselaers in a paper published in 1991.[5] The first full-round MD4 collision attack was found by Hans Dobbertin in 1995, which took only seconds to carry out at that time.[6] In August 2004, Wang et al. found a very efficient collision attack, alongside attacks on later hash function designs in the MD4/MD5/SHA-1/RIPEMD family. This result was improved later by Sasaki et al., and generating a collision is now as cheap as verifying it (a few microseconds).[2] In 2008, the preimage resistance of MD4 was also broken by Gaëtan Leurent, with a 2102 attack.[7] In 2011, RFC 6150 stated that RFC 1320 (MD4) is historic (obsolete). MD4 hashesThe 128-bit (16-byte) MD4 hashes (also termed message digests) are typically represented as 32-digit hexadecimal numbers. The following demonstrates a 43-byte ASCII input and the corresponding MD4 hash: MD4("The quick brown fox jumps over the lazy {{Background color|#87CEEB|d}}og") = 1bee69a46ba811185c194762abaeae90Even a small change in the message will (with overwhelming probability) result in a completely different hash, e.g. changing d to c: MD4("The quick brown fox jumps over the lazy {{Background color|#87CEEB|c}}og") = b86e130ce7028da59e672d56ad0113dfThe hash of the zero-length string is: MD4 test vectorsThe following test vectors are defined in RFC 1320 (The MD4 Message-Digest Algorithm) MD4 ("") = 31d6cfe0d16ae931b73c59d7e0c089c0 MD4 ("a") = bde52cb31de33e46245e05fbdbd6fb24 MD4 ("abc") = a448017aaf21d8525fc10ae87aa6729d MD4 ("message digest") = d9130a8164549fe818874806e1c7014b MD4 ("abcdefghijklmnopqrstuvwxyz") = d79e1c308aa5bbcdeea8ed63df412da9 MD4 ("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789") = 043f8582f241db351ce627e153e7f0e4 MD4 ("12345678901234567890123456789012345678901234567890123456789012345678901234567890") = e33b4ddc9c38f2199c3e7b164fcc0536MD4 collision exampleLet: k1 = 839c7a4d7a92cb{{red|5}}678a5d5{{red|b}}9eea5a7573c8a74deb366c3dc20a083b69f5d2a3bb3719dc69891e9f95e809fd7e8b23ba6318ed{{red|d}}45e51fe39708bf9427e9c3e8b9 k2 = 839c7a4d7a92cb{{red|d}}678a5d5{{red|2}}9eea5a7573c8a74deb366c3dc20a083b69f5d2a3bb3719dc69891e9f95e809fd7e8b23ba6318ed{{red|c}}45e51fe39708bf9427e9c3e8b9k1 ≠ k2, but MD4(k1) = MD4(k2) = 4d7e6a1defa93d2dde05b45d864c429b Note that two hex-digits of k1 and k2 define one byte of the input string, whose length is 64 bytes . See also
References
1. ^{{cite web|url=http://tools.ietf.org/html/rfc1186 |title=The MD4 Message Digest Algorithm |publisher=Network Working Group |date=October 1990 |accessdate=2011-04-29}} 2. ^1 2 {{cite journal |author=Yu Sasaki|year=2007 |title=New message difference for MD4 |url=https://www.iacr.org/archive/fse2007/45930331/45930331.pdf|display-authors=etal}} 3. ^{{cite web |url=http://www.rsa.com/rsalabs/node.asp?id=2253 |title=What are MD2, MD4, and MD5? |accessdate=2011-04-29 |publisher=RSA Laboratories |work=Public-Key Cryptography Standards (PKCS): PKCS #7: Cryptographic Message Syntax Standard: 3.6 Other Cryptographic Techniques: 3.6.6 What are MD2, MD4, and MD5? |deadurl=yes |archiveurl=https://www.webcitation.org/61AADFziE?url=http://www.rsa.com/rsalabs/node.asp?id=2253 |archivedate=2011-08-23 |df= }} 4. ^{{cite web |url=http://msdn.microsoft.com/en-us/library/cc236715(v=PROT.10).aspx |title=5.1 Security Considerations for Implementors |accessdate=2011-07-21 |quote=Deriving a key from a password is as specified in [RFC1320] and [FIPS46-2].}} 5. ^{{cite journal |author=Bert den Boer, Antoon Bosselaers |year=1991 |title=An Attack on the Last Two Rounds of MD4 |url=http://dsns.csie.nctu.edu.tw/research/crypto/HTML/PDF/C91/194.PDF |deadurl=yes |archiveurl=https://web.archive.org/web/20030523231212/http://dsns.csie.nctu.edu.tw/research/crypto/HTML/PDF/C91/194.PDF |archivedate=2003-05-23 |df= }} 6. ^{{cite journal |author=Hans Dobbertin |date=1995-10-23 |title=Cryptanalysis of MD4 |journal=Journal of Cryptology |volume=11 |issue=4 |pages=253–271 |doi=10.1007/s001459900047 }} 7. ^{{cite journal |author=Gaëtan Leurent |date=2008-02-10 |title=MD4 is Not One-Way |publisher=FSE 2008 |url=http://www.di.ens.fr/~leurent/files/MD4_FSE08.pdf }} External links
Collision attacks
1 : Broken hash functions |
| 随便看 |
|
开放百科全书收录14589846条英语、德语、日语等多语种百科知识，基本涵盖了大多数领域的百科知识，是一部内容自由、开放的电子版国际百科全书。