Problem - Kevin Tafuro

Let’s look briefly at the pros and cons of using these functions.
Davies-Meyer
This function is one way of turning block ciphers into one-way hash functions
(Matyas-Meyer-Oseas is a similar technique that is also commonly seen). This
technique does not thwart birthday attacks without additional measures, and it’s
therefore an inappropriate construct to use with most block ciphers because
most ciphers have 64-bit blocks. AES is a good choice for this construct, though
64 bits of resistance to birthday attacks is somewhat liberal. While we believe
this to be adequate for the time being, it’s good to be forward-thinking and
require something with at least 80 bits of resistance against a birthday attack. If
you use Davies-Meyer with a nonce, it offers sufficient security. We show how to
implement Davies-Meyer in Recipe 6.15.
MD2
MD2 (Message Digest 2 from Ron Rivest *) isn’t used in many situations. It is
optimized for 16-bit platforms and runs slowly everywhere else. It also hasn’t
seen much scrutiny, has an internal structure now known to be weak, and has a
small digest size. For these reasons, we strongly suggest that you use other alternatives
if at all possible.
MD4, MD5
As we mentioned, MD4 (Message Digest 4 from Ron Rivest) is still used in some
applications, but it is quite broken and should not be used, while MD5 should
be avoided as well, because its internal structure is known to be quite weak. This
doesn’t necessarily amount to a practical attack, but cryptographers do not recommend
the algorithm for new applications because there probably is a practical
attack waiting to be found.
MDC-2
MDC-2 is a way of improving Matyas-Meyer-Oseas to give an output that offers
twice as many bits of security (i.e., the digest is two blocks wide). This clearly
imposes a speed hit over Matyas-Meyer-Oseas, but it avoids the need for a
nonce. Generally, when people say “MDC-2,” they’re talking about a DES-based
implementation. We show how to implement MDC-2-AES in Recipe 6.16.
RIPEMD-160, SHA1
RIPEMD-160 and SHA1 are both well-regarded hash functions with reasonable
performance characteristics. SHA1 is a bit more widely used, partially because it
is faster, and partially because the National Institute of Standards and Technology
(NIST) has standardized it. While there is no known attack better than a
birthday attack against either of these algorithms, RIPEMD-160 is generally
regarded as having a somewhat more conservative design, but SHA1 has seen
more study.
* MD1 was never public, nor was MD3.
Choosing a Cryptographic Hash Algorithm | 257
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.