4

Edit: ok, after I re-read the paper a couple of times it is clear that Table 6 is easily derived from Table 5, which describes the collision differential. So the real question is: how did the authors come up with the collision differential?

Original question:

The paper Cryptanalysis of the Hash Functions MD4 and RIPEMD describes a set of sufficient conditions for collisions of MD4 (Table 6 in the paper). The authors explain how to verify these conditions, but there is no info about how they got them in the first place. I'm curious, what could be a possible procedure?

0x00
  • 417
  • 2
  • 8

1 Answers1

1

I've found the following tweet:

[...] all the papers I've read say that she found the right difference patterns by "intuition"

(https://twitter.com/ghostly_gray/status/906009834755055617)

I'll happily accept another, more specific answer!

0x00
  • 417
  • 2
  • 8