Cryptanalysis of MDC-2

We provide a collision attack and preimage attacks on the MDC-2 construction, which is a method (dating back to 1988) of turning an n-bit block cipher into a 2n-bit hash function. The collision attack is the first below the birthday bound to be described for MDC-2 and, with n = 128, it has complexity 2124.5 , which is to be compared to the birthday attack having complexity 2128 . The preimage attacks constitute new time/memory trade-offs; the most efficient attack requires time and space about 2n , which is to be compared to the previous best known preimage attack of Lai and Massey (Eurocrypt '92), having time complexity 23n/2 and space complexity 2n/2 , and to a brute force preimage attack having complexity 22n .

• Type: Conference
• Year: 2009
• Where: EUROCRYPT
• Authors: Christian Rechberger, Florian Mendel, Lars R. Knudsen, Søren S. Thomsen
• Keywords: Attack Having Complexity, Attack Requires Time, Collision Attack, Cryptography, EUROCRYPT 2009