rust-crypto icon indicating copy to clipboard operation
rust-crypto copied to clipboard

Add md4 hash function

Open bacher09 opened this issue 9 years ago • 2 comments

I added md4 hash function with tests and benchmarks. Some parts of code are based on md5.rs since they are similar algorithms.

bacher09 avatar Jun 07 '15 14:06 bacher09

MD4 is known to be weak since 1991, was broken first in 1995 and obsolete since 2011. You really shouldn't use it any more. There is no reason to use MD4 any more except if you are interacting with historic software. If you really, really want to implent that, please put a huge big warning in both documentation and runtime usage.

genodeftest avatar Feb 23 '16 16:02 genodeftest

Yes, I know that md4 is weak. Moreover, md5 are also weak, but this library are supporting it without any warning. Most of modern cryptography libraries still support it despite it weakness, since there are a lot of valid use case that require it. For example, md4 is supported:

It still has a lot of valid use case, it can be used for deal with legacy network protocol or legacy binary format, it can be used as non cryptographic hash function, it can be used for implementing bruteforcer. Moreover, it sometimes still used as cryptographic hash functions in some firmware (relatively new firmware), for example some firmware ever use CRC function (which is non cryptocraphic hash function) for storing BIOS password (this is fully insecure).

Also, I don't see any benefits to add warning about weakness of md4, if programmer are working with cryptography he or she should already know pros and cons of algorithm that he/she is going to use. Otherwise, he/she shouldn't deal with cryptography.

bacher09 avatar Feb 24 '16 20:02 bacher09