{"type":"ScholarlyArticle","title":"Inverting 43-step MD4 via Cube-and-Conquer","authors":[{"name":"Oleg Zaikin","slug":"oleg-zaikin","given":"Oleg","family":"Zaikin","affiliation":"Swansea University"}],"abstract":"MD4 is a prominent cryptographic hash function proposed in 1990. The full version consists of 48 steps and produces a hash of size 128 bits given a message of an arbitrary finite size. In 2007, its truncated 39-step version was inverted via reducing to SAT and applying a CDCL solver. Since that time, several attempts have been made but the 40-step version still remains unbroken. In this study, 40-, 41-, 42-, and 43-step versions of MD4 are successfully inverted. The problems are reduced to SAT and solved via the Cube-and-Conquer approach. Two algorithms are proposed for this purpose. The first one generates inversion problems for MD4 by adding special constraints. The second one is aimed at finding a proper threshold for the cubing phase of Cube-and-Conquer. While the first algorithm is focused on inverting MD4 and similar cryptographic hash functions, the second one is not area specific and so is applicable to a variety of classes of hard SAT instances.","doi":"10.24963/ijcai.2022/263","url":"https://ijcai.org/proceedings/2022/263","pdf":"https://ijcai.org/proceedings/2022/0263.pdf","markdown":"https://ijcai.org/proceedings/2022/263.md","bibtex":"https://ijcai.org/proceedings/2022/bibtex/263","volume":{"slug":"2022","title":"Proceedings of the Thirty-First International Joint Conference on Artificial Intelligence","short_title":"IJCAI 2022","url":"https://ijcai.org/proceedings/2022/","year":2022,"location":"Vienna","dates":"23-29 July 2022","editors":"Luc De Raedt","isbn":"978-1-956792-00-3","publisher":"International Joint Conferences on Artificial Intelligence Organization","doi_prefix":"10.24963/ijcai.2022"},"section":"Constraint Satisfaction and Optimization","track":"Main Track","number":263,"pages":{"first":1894,"last":1900},"keywords":["Constraint Satisfaction and Optimization: Satisfiabilty","Constraint Satisfaction and Optimization: Applications","Constraint Satisfaction and Optimization: Solvers and Tools"],"videos":[{"label":"Video #1","url":"https://slideslive.com/38986932","length_sec":80,"provider":"slideslive"},{"label":"Video #2","url":"https://slideslive.com/38985075","length_sec":358,"provider":"slideslive"}],"references":[{"position":1,"raw":"[Biere et al., 2021] Armin Biere, Mathias Fleury, and Max- imillian Heisinger. CaDiCaL, Kissat, Paracooba entering the SAT Competition 2021. In SAT Competition 2021 - Solver and Benchmark Descriptions, pages 10-13. Uni- versity of Helsinki, 2021.","title":"CaDiCaL, Kissat, Paracooba entering the SAT Competition 2021. In SAT Competition 2021 -Solver and Benchmark Descriptions","authors":"Biere","year":"2021","venue":null,"doi":null,"url":null,"internal_url":null},{"position":2,"raw":"[Bright et al., 2021] Curtis Bright, Kevin K. H. Cheung, Brett Stevens, Ilias S. Kotsireas, and Vijay Ganesh. A SAT-based resolution of Lam's problem. In AAAI, pages 3669-3676, 2021.","title":"A SAT-based resolution of Lam's problem","authors":"Curtis Bright, Kevin K H Cheung, Brett Stevens, Ilias S Kotsireas, Vijay Ganesh","year":"2021","venue":"AAAI","doi":null,"url":null,"internal_url":null},{"position":3,"raw":"[De et al., 2007] Debapratim De, Abishek Kumarasubrama- nian, and Ramarathnam Venkatesan. Inversion attacks on secure hash functions using SAT solvers. In SAT, pages 377-382, 2007.","title":"Debapratim De, Abishek Kumarasubramanian, and Ramarathnam Venkatesan. Inversion attacks on secure hash functions using SAT solvers","authors":"De","year":"2007","venue":"SAT","doi":null,"url":null,"internal_url":null},{"position":4,"raw":"[Dobbertin, 1996] Hans Dobbertin. Cryptanalysis of MD4. In FSE, pages 53-69, 1996.","title":"Cryptanalysis of MD4","authors":"Hans Dobbertin, Dobbertin","year":"1996","venue":"FSE","doi":null,"url":null,"internal_url":null},{"position":5,"raw":"[Dobbertin, 1998] Hans Dobbertin. The first two rounds of MD4 are not one-way. In FSE, pages 284-292, 1998.","title":"The first two rounds of MD4 are not one-way","authors":"Hans Dobbertin, Dobbertin","year":"1998","venue":"FSE","doi":null,"url":null,"internal_url":null},{"position":6,"raw":"[Dowling and Gallier, 1984] William F. Dowling and Jean H. Gallier. Linear-time algorithms for testing the satisfiability of propositional horn formulae. J. Log. Program., 1(3):267-284, 1984.","title":"Linear-time algorithms for testing the satisfiability of propositional horn formulae","authors":"William F Dowling, Jean H Gallier","year":"1984","venue":"J. Log. Program","doi":null,"url":null,"internal_url":null},{"position":7,"raw":"[Eén and Biere, 2005] Niklas Eén and Armin Biere. Effec- tive preprocessing in SAT through variable and clause elimination. In SAT, pages 61-75. Springer, 2005.","title":"Effective preprocessing in SAT through variable and clause elimination","authors":"Biere Eén, Niklas Eén, Armin Biere","year":"2005","venue":"SAT","doi":null,"url":null,"internal_url":null},{"position":8,"raw":"[Gribanova and Semenov, 2018] Irina Gribanova and Alexander A. Semenov. Using automatic generation of relaxation constraints to improve the preimage attack on 39-step MD4. In MIPRO, pages 1174-1179, 2018.","title":"Using automatic generation of relaxation constraints to improve the preimage attack on 39-step MD4","authors":"Irina Gribanova, Alexander A Semenov","year":"2018","venue":"MIPRO","doi":null,"url":null,"internal_url":null},{"position":9,"raw":"[Gribanova et al., 2017] Irina Gribanova, Oleg Zaikin, Stepan Kochemazov, Ilya Otpuschennikov, and Alexander Semenov. The study of inversion problems of crypto- graphic hash functions from MD family using algorithms for solving Boolean satisfiability problem. In MIT, pages 98-113, 2017.","title":"The study of inversion problems of cryptographic hash functions from MD family using algorithms for solving Boolean satisfiability problem","authors":"Irina Gribanova, Oleg Zaikin, Stepan Kochemazov, Ilya Otpuschennikov, Alexander Semenov","year":"2017","venue":null,"doi":null,"url":null,"internal_url":null},{"position":10,"raw":"[Heule and van Maaren, 2009] Marijn Heule and Hans van Maaren. Look-ahead based SAT solvers. In Handbook of Satisfiability, pages 155-184. IOS Press, 2009.","title":"Look-ahead based SAT solvers","authors":"Heule, ; Van Maaren, Marijn Heule, Hans Van Maaren","year":"2009","venue":"Handbook of Satisfiability","doi":null,"url":null,"internal_url":null},{"position":11,"raw":"[Heule et al., 2011] Marijn Heule, Oliver Kullmann, Siert Wieringa, and Armin Biere. Cube and conquer: Guiding CDCL SAT solvers by lookaheads. In HVC, pages 50-65, 2011.","title":"Cube and conquer: Guiding CDCL SAT solvers by lookaheads","authors":"Marijn Heule, Oliver Kullmann, Siert Wieringa, Armin Biere","year":"2011","venue":"HVC","doi":null,"url":null,"internal_url":null},{"position":12,"raw":"[Heule et al., 2016] Marijn J. H. Heule, Oliver Kullmann, and Victor W. Marek. Solving and verifying the Boolean Pythagorean triples problem via Cube-and-Conquer. In SAT, pages 228-245, 2016.","title":"Solving and verifying the Boolean Pythagorean triples problem via Cube-and-Conquer","authors":"J H Marijn, Heule, Victor W Oliver Kullmann, Marek","year":"2016","venue":"SAT","doi":null,"url":null,"internal_url":null},{"position":13,"raw":"[Heule, 2018] Marijn J. H. Heule. Schur number five. In AAAI, pages 6598-6606, 2018.","title":"Schur number five","authors":"J H Marijn, Heule","year":"2018","venue":"AAAI","doi":null,"url":null,"internal_url":null},{"position":14,"raw":"[Homsirikamol et al., 2012] Ekawat Homsirikamol, Pawel Morawiecki, Marcin Rogawski, and Marian Srebrny. Security margin evaluation of SHA-3 contest finalists through SAT-based attacks. In CISIM, pages 56-67, 2012.","title":"Security margin evaluation of SHA-3 contest finalists through SAT-based attacks","authors":"Homsirikamol","year":"2012","venue":"CISIM","doi":null,"url":null,"internal_url":null},{"position":15,"raw":"[Hyvärinen et al., 2010] Antti Eero Johannes Hyvärinen, Tommi A. Junttila, and Ilkka Niemelä. Partitioning SAT instances for distributed solving. In LPAR, pages 372-386, 2010.","title":"Partitioning SAT instances for distributed solving","authors":"Hyvärinen","year":"2010","venue":"LPAR","doi":null,"url":null,"internal_url":null},{"position":16,"raw":"[Jovanovic and Janicic, 2005] Dejan Jovanovic and Predrag Janicic. Logical analysis of hash functions. In FroCoS, pages 200-215, 2005.","title":"Logical analysis of hash functions","authors":"Dejan Jovanovic, Predrag Janicic","year":"2005","venue":"FroCoS","doi":null,"url":null,"internal_url":null},{"position":17,"raw":"[Konev and Lisitsa, 2015] Boris Konev and Alexei Lisitsa. Computer-aided proof of Erdős discrepancy properties. Artif. Intell., 224:103-118, 2015.","title":"Computer-aided proof of Erdős discrepancy properties","authors":"Lisitsa Konev","year":"2015","venue":"Artif. Intell","doi":null,"url":null,"internal_url":null},{"position":18,"raw":"[Kullmann, 2009] Oliver Kullmann. Fundaments of branch- ing heuristics. In Handbook of Satisfiability, pages 205- 244. IOS Press, 2009.","title":"Fundaments of branching heuristics","authors":"Oliver Kullmann","year":"2009","venue":"Handbook of Satisfiability","doi":null,"url":null,"internal_url":null},{"position":19,"raw":"[Lafitte et al., 2014] Frédéric Lafitte, Jorge Nakahara Jr., and Dirk Van Heule. Applications of SAT solvers in cryptanal- ysis: Finding weak keys and preimages. J. Satisf. Boolean Model. Comput., 9(1):1-25, 2014.","title":"Applications of SAT solvers in cryptanalysis: Finding weak keys and preimages","authors":"Frédéric Lafitte, Jorge Nakahara, Dirk Van Heule","year":"2014","venue":"J. Satisf. Boolean Model. Comput","doi":null,"url":null,"internal_url":null},{"position":20,"raw":"[Legendre et al., 2012] Florian Legendre, Gilles Dequen, and Michaël Krajecki. Encoding hash functions as a SAT problem. In ICTAI, pages 916-921, 2012.","title":"Encoding hash functions as a SAT problem","authors":"Legendre","year":"2012","venue":"ICTAI","doi":null,"url":null,"internal_url":null},{"position":21,"raw":"[Leurent, 2008] Gaëtan Leurent. MD4 is not one-way. In FSE, pages 412-428, 2008.","title":"MD4 is not one-way","authors":"Gaëtan Leurent","year":"2008","venue":"FSE","doi":null,"url":null,"internal_url":null},{"position":22,"raw":"[Marques-Silva and Sakallah, 1999] João P. Marques-Silva and Karem A. Sakallah. GRASP: A search algorithm for propositional satisfiability. IEEE Trans. Computers, 48(5):506-521, 1999.","title":"GRASP: A search algorithm for propositional satisfiability","authors":"P João, Karem A Marques-Silva, Sakallah","year":"1999","venue":"IEEE Trans. Computers","doi":null,"url":null,"internal_url":null},{"position":23,"raw":"[Menezes et al., 1996] Alfred Menezes, Paul C. van Oorschot, and Scott A. Vanstone. Handbook of Applied Cryptography. CRC Press, 1996.","title":"Handbook of Applied Cryptography","authors":"Menezes","year":"1996","venue":null,"doi":null,"url":null,"internal_url":null},{"position":24,"raw":"[Mironov and Zhang, 2006] Ilya Mironov and Lintao Zhang. Applications of SAT solvers to cryptanalysis of hash func- tions. In SAT, pages 102-115, 2006.","title":"Applications of SAT solvers to cryptanalysis of hash functions","authors":"Zhang Mironov, Ilya Mironov, Lintao Zhang","year":"2006","venue":"SAT","doi":null,"url":null,"internal_url":null},{"position":25,"raw":"[Nejati et al., 2017] Saeed Nejati, Jia Hui Liang, Cather- ine H. Gebotys, Krzysztof Czarnecki, and Vijay Ganesh. Adaptive restart and CEGAR-based solver for inverting cryptographic hash functions. In VSTTE, pages 120-131, 2017.","title":"Adaptive restart and CEGAR-based solver for inverting cryptographic hash functions","authors":"Saeed Nejati, Jia Hui Liang, Catherine H Gebotys, Krzysztof Czarnecki, Vijay Ganesh","year":"2017","venue":"VSTTE","doi":null,"url":null,"internal_url":null},{"position":26,"raw":"[Nossum, 2012] Vegard Nossum. SAT-based preimage at- tacks on SHA-1. Master's thesis, University of Oslo, De- partment of Informatics, 2012.","title":"SAT-based preimage attacks on SHA-1","authors":"Vegard Nossum","year":"2012","venue":null,"doi":null,"url":null,"internal_url":null},{"position":27,"raw":"[Rivest, 1990] Ronald L. Rivest. The MD4 message digest algorithm. In CRYPTO, pages 303-311, 1990.","title":"The MD4 message digest algorithm","authors":"L Ronald, Rivest","year":"1990","venue":"CRYPTO","doi":null,"url":null,"internal_url":null},{"position":28,"raw":"[Semenov et al., 2020] Alexander A. Semenov, Ilya V. Ot- puschennikov, Irina Gribanova, Oleg Zaikin, and Stepan Kochemazov. Translation of algorithmic descriptions of discrete functions to SAT with applications to cryptanaly- sis problems. Log. Methods Comput. Sci., 16(1), 2020.","title":"Translation of algorithmic descriptions of discrete functions to SAT with applications to cryptanalysis problems","authors":"Alexander A Semenov, V Ilya, Irina Otpuschennikov, Oleg Gribanova, Stepan Zaikin, Kochemazov","year":"2020","venue":"Log. Methods Comput. Sci","doi":null,"url":null,"internal_url":null},{"position":29,"raw":"[Tseitin, 1970] Grigori S Tseitin. On the complexity of derivation in propositional calculus. Studies in construc- tive mathematics and mathematical logic, part II, Semi- nars in mathematics, pages 115-125, 1970.","title":"On the complexity of derivation in propositional calculus","authors":"Grigori S Tseitin","year":"1970","venue":"Studies in constructive mathematics and mathematical logic, part II, Seminars in mathematics","doi":null,"url":null,"internal_url":null},{"position":30,"raw":"[Wang et al., 2005] Xiaoyun Wang, Xuejia Lai, Dengguo Feng, Hui Chen, and Xiuyuan Yu. Cryptanalysis of the hash functions MD4 and RIPEMD. In EUROCRYPT, pages 1-18, 2005.","title":"Cryptanalysis of the hash functions MD4 and RIPEMD","authors":"Xiaoyun Wang, Xuejia Lai, Dengguo Feng, Hui Chen, Xiuyuan Yu","year":"2005","venue":"EUROCRYPT","doi":null,"url":null,"internal_url":null}],"license_note":"Copyright International Joint Conferences on Artificial Intelligence."}