MD2 is not secure without the checksum byte (Q1369723)

Security properties of the MD2 Message Digest Algorithm are investigated. First the MD2 hash function is described and general properties of one of its basic blocks -- so called ``compression'' function are investigated. Then it is shown how to find collisions for the compression function in the cases where one input of the function is either equal to zero or ends with consecutive zeros. As the MD2 compression function is shown not to be collision-free, it is concluded that the security of MD2 is in fact based on the redundancy introduced by the checksum block added to the input message.