In this paper we construct preimage attack on the truncated variant of the MD4 hash function. Specifically, we study the MD4-39 function defined by the first 39 steps of the MD4 algorithm. We suggest a new attack on MD4-39, which develops the ideas proposed by H. Dobbertin in 1998. Namely, the special relaxation constraints are introduced in order to simplify the equations corresponding to the problem of finding a preimage for an arbitrary MD4-39 hash value. The equations supplemented with the relaxation constraints are then reduced to the Boolean Satisfiability Problem (SAT) and solved using the state-of-the-art SAT solvers. We show that the effectiveness of a set of relaxation constraints can be evaluated using the black-box function of a special kind. Thus, we suggest automatic method of relaxation constraints generation by applying the black-box optimization to this function. The proposed method made it possible to find new relaxation constraints that contribute to a SAT-based preimage attack on MD4-39 which significantly outperforms the competition.

The LobachevskiY plane has the well-known Liouville model in the half-plane y > 0 of the plane R 2 = {(x, y) [ z, y E R}. The group F:z ~=az+/~, yl=ay, a>0,-co 0, generated by translations along the z-axis and similaxity transformations with center the origin, is a simply transitive subgroup of the motion group of the Lobachevskil plane in the LiouviUe model. Therefore, the metric with the line element ds = y-lvIdz2 + dy 2 on the LobachevskiY plane is a left-invariant intrinsic metric on the group F. In the present article we study all metrics with this property. According to [1], every left-invariant intrinsic metric on a Lie group G is a nonholonomic Finsler metric in the general case. Such a metric is defined by a pair (A, ~), where ~ is a left-invariant norm on a left-invariant distribution A generating the tangent bundle TG by the taking of repeated Lie brackets. Since in our case the Lie group P is two-dimensional and since every one-dimensional distribution is integrable, A coincides with TF. Hence, the metric p on I" is a Finder metric; i.e., the distance between the points pl = (Zl,yl) and p2 = (z2,y2) of the half-plane y > 0 is defined by the formula Omsk.

In this paper we study the inversion problem of MD4 cryptographic hash function developed by R. Rivest in 1990. By MD4-k we denote a truncated variant of MD4 hash function in which k represents a number of steps used to calculate a hash value (the full version of MD4 function corresponds to MD4-48). H. Dobbertin has showed that MD4-32 hash function is not one-way, namely, it can be inverted for the given image of a random input. He suggested to add special conditions to the equations that describe the computation of concrete steps (chaining variables) of the considered hash function. These additional conditions allowed to solve the inversion problem of MD4-32 within a reasonable time by solving corresponding system of equations. The main result of the present paper is an automatic derivation of "Dobbertin's conditions" using parallel SAT solving algorithms. We also managed to solve several inversion problems of functions of the kind MD4-k (for k from 31 up to 39 inclusive). Our method significantly outperforms previously existing approaches to solving these problems.

No abstract

No abstract