Cryptanalysis of MDC-2

  • Authors:
  • Lars R. Knudsen;Florian Mendel;Christian Rechberger;Søren S. Thomsen

  • Affiliations:
  • Department of Mathematics, Technical University of Denmark, Lyngby, Denmark DK-2800 Kgs.;Institute for Applied Information Processing and Communications (IAIK), Graz University of Technology, Graz, Austria A-8010;Institute for Applied Information Processing and Communications (IAIK), Graz University of Technology, Graz, Austria A-8010;Department of Mathematics, Technical University of Denmark, Lyngby, Denmark DK-2800 Kgs.

  • Venue:
  • EUROCRYPT '09 Proceedings of the 28th Annual International Conference on Advances in Cryptology: the Theory and Applications of Cryptographic Techniques
  • Year:
  • 2009

Quantified Score

Hi-index 0.00

Visualization

Abstract

We provide a collision attack and preimage attacks on the MDC-2 construction, which is a method (dating back to 1988) of turning an n -bit block cipher into a 2n -bit hash function. The collision attack is the first below the birthday bound to be described for MDC-2 and, with n = 128, it has complexity 2124.5, which is to be compared to the birthday attack having complexity 2128. The preimage attacks constitute new time/memory trade-offs; the most efficient attack requires time and space about 2 n , which is to be compared to the previous best known preimage attack of Lai and Massey (Eurocrypt '92), having time complexity 23n /2 and space complexity 2 n /2, and to a brute force preimage attack having complexity 22n .