MD2 is not secure without the checksum byte

DOI10.1023/A:1008220711840MaRDI QIDQ1369723zbMATH OpenWikidataFDO

Authors N. Rogier, Pascal Chauvaud

Publication date 27 January 1998

Published in Designs, Codes and Cryptography (Search for Journal in Brave)

Full work available at URL https://doi.org/10.1023/A:1008220711840

zbMATH Keywords

collisionhashing functionmessage digest

Mathematics Subject Classification ID

Cryptography (94A60)

Review text

Security properties of the MD2 Message Digest Algorithm are investigated. First the MD2 hash function is described and general properties of one of its basic blocks -- so called ``compression function are investigated. Then it is shown how to find collisions for the compression function in the cases where one input of the function is either equal to zero or ends with consecutive zeros. As the MD2 compression function is shown not to be collision-free, it is concluded that the security of MD2 is in fact based on the redundancy introduced by the checksum block added to the input message.

Recommendations

• The MD2 Hash Function Is Not One-Way
• MD5 is weaker than weak: attacks on concatenated combiners
• Linear-XOR and Additive Checksums Don’t Protect Damgård-Merkle Hashes from Generic Attacks
• Cryptanalysis of MD2
• INT-RUP security of checksum-based authenticated encryption
• Information and Communications Security
• A New Type of 2-Block Collisions in MD5
• scientific article; zbMATH DE number 503328
• Characterizing Padding Rules of MD Hash Functions Preserving Collision Security

Cited in

(3)

• Cryptanalysis of MD2
• A Chosen Text Attack on The Modified Cryptographic Checksum Algorithm of Cohen and Huang
• Linear-XOR and Additive Checksums Don’t Protect Damgård-Merkle Hashes from Generic Attacks

This page was built for publication: MD2 is not secure without the checksum byte

Report a bug (only for logged in users!)Click here to report a bug for this page (MaRDI item Q1369723)