Unkeyed cryptographic · broken

MD4

Designed by Ronald Rivest in 1990 (RFC 1320). MD4 is the structural ancestor of MD5, SHA-1, SHA-2, and RIPEMD , the prototype that established the “four-round, three-message-block operations per round” pattern those families inherited. Comprehensively broken since Dobbertin’s 1996 collision attack; still encountered in legacy NTLM and rsync.

At a glance

Where it still shows up

• NTLM , MD4 of the UTF-16 password is the NT hash. Still in use across legacy Windows authentication.
• rsync , default file-content rolling hash + checksum, in MD4 mode for backward compatibility.
• S/KEY one-time passwords (RFC 1760) , iterated MD4.
• WebDAV ETag systems , some legacy servers.

How it broke

Hans Dobbertin in 1996 demonstrated practical MD4 collisions (seconds on contemporary hardware) by finding a high-probability differential through the compression function. Wang et al. later produced collisions in microseconds. Modifying-an-existing-message attacks took only a few seconds even on 1990s hardware , MD4 was truly out of cryptographic service by the late 1990s.

Why it’s historically important

Almost every modern hash before SHA-3 traces its lineage to MD4: the four-round nonlinear Boolean function structure, the message-schedule idea, the chaining-variable concept. Studying MD4’s failure modes was foundational for differential cryptanalysis of hash functions, and the attacks shipped on it have direct analogues in the Wang-Yu attacks on MD5 and SHA-1.

References

• RFC 1320 , The MD4 Message-Digest Algorithm
• RFC 6150 , MD4 to Historic Status
• Dobbertin, “The status of MD5 after a recent attack,” CryptoBytes, 1996.
• MD5