Preimage Attack on MD4 Hash Function as a Problem of Parallel Sat-Based Cryptanalysis

Abstract

In this paper we study the inversion problem of MD4 cryptographic hash function developed by R. Rivest in 1990. By MD4-k we denote a truncated variant of MD4 hash function in which k represents a number of steps used to calculate a hash value (the full version of MD4 function corresponds to MD4-48). H. Dobbertin has showed that MD4-32 hash function is not one-way, namely, it can be inverted for the given image of a random input. He suggested to add special conditions to the equations that describe the computation of concrete steps (chaining variables) of the considered hash function. These additional conditions allowed to solve the inversion problem of MD4-32 within a reasonable time by solving corresponding system of equations. The main result of the present paper is an automatic derivation of "Dobbertin's conditions" using parallel SAT solving algorithms. We also managed to solve several inversion problems of functions of the kind MD4-k (for k from 31 up to 39 inclusive). Our method significantly outperforms previously existing approaches to solving these problems.

Converting of Boolean Expression to Linear Equations, Inequalities and QUBO Penalties for Cryptanalysis

“…Another approach based on the SAT for the MD-family hash functions was considered in Refs. [16,17]. In these papers, they used an idea similar to what we use in this work, but they converted the pre-image attack to the SAT problem as we convert it into the MILP problems.…”

“…In Ref. [16], they successfully committed an attack on the MD4 with 39 rounds under Dobbertin's conditions [18].…”

“…An input message has 128 bits and is represented as 4 × 4 with one byte element, termed the state. For instance, let b be the input message with 128 bits or equivalently 16 As we mentioned before, we divide the algorithm into smaller parts, transform to linear equations (or QUBO) and merge all parts. Note that the mentioned steps consist of XOR, shifting and operations in Rijndael's finite field.…”