MD6

{{Short description|Cryptographic hash function}}

{{Other uses|MD-6 (disambiguation){{!}}MD-6}}

{{Infobox cryptographic hash function

| name = MD6

| image =

| caption =

| designers = Ronald Rivest, Benjamin Agre, Dan Bailey, Sarah Cheng, Christopher Crutchfield, Yevgeniy Dodis, Kermin Fleming, Asif Khan, Jayant Krishnamurthy, Yuncheng Lin, Leo Reyzin, Emily Shen, Jim Sukha, Eran Tromer, Yiqun Lisa Yin

| publish date = 2008

| series = MD2, MD4, MD5, MD6

| derived from =

| derived to =

| related to =

| certification =

| digest size = Variable, 0

| structure = Merkle tree

| rounds = Variable. Default, Unkeyed=40+[d/4], Keyed=max(80,40+(d/4))

| cryptanalysis = Key-recovery attack of a 14-round MD6 function in 2²² operations.{{cite book | last=Aumasson | first=Jean-Philippe | last2=Dinur | first2=Itai | last3=Meier | first3=Willi | last4=Shamir | first4=Adi | title=Fast Software Encryption | chapter=Cube Testers and Key Recovery Attacks on Reduced-Round MD6 and Trivium | publisher=Springer Berlin Heidelberg | publication-place=Berlin, Heidelberg | volume=5665 | date=2009 | isbn=978-3-642-03316-2 | doi=10.1007/978-3-642-03317-9_1 | page=1–22}}

}}

The MD6 Message-Digest Algorithm is a cryptographic hash function. It uses a Merkle tree-like structure to allow for immense parallel computation of hashes for very long inputs. Authors claim a performance of 28 cycles per byte for MD6-256 on an Intel Core 2 Duo and provable resistance against differential cryptanalysis.{{cite web

| author = Ronald L. Rivest

| url = http://people.csail.mit.edu/rivest/Rivest-TheMD6HashFunction.ppt

| title = The MD6 hash function A proposal to NIST for SHA-3

| access-date = 2008-10-07

| archive-date = 2020-11-09

| archive-url = https://web.archive.org/web/20201109011321/http://people.csail.mit.edu/rivest/Rivest-TheMD6HashFunction.ppt

| url-status = dead

}}

(Microsoft PowerPoint file) The source code of the reference implementation was released under MIT license.[http://groups.csail.mit.edu/cis/md6/diffamp/README.txt readme.txt]

Speeds in excess of 1 GB/s have been reported to be possible for long messages on 16-core CPU architecture.{{cite web

| author = Ronald L. Rivest

| display-authors = etal

| url = http://groups.csail.mit.edu/cis/md6/submitted-2008-10-27/Supporting_Documentation/md6_report.pdf

| title = The MD6 Hash Function

| access-date = 2024-01-29

| archive-date = 2017-08-12

| archive-url = https://web.archive.org/web/20170812072847/https://groups.csail.mit.edu/cis/md6/submitted-2008-10-27/Supporting_Documentation/md6_report.pdf

| url-status = dead

}}

In December 2008, Douglas Held of Fortify Software discovered a buffer overflow in the original MD6 hash algorithm's reference implementation. This error was later made public by Ron Rivest on 19 February 2009, with a release of a corrected reference implementation in advance of the Fortify Report.{{cite web | url=http://blog.fortify.com/repo/Fortify-SHA-3-Report.pdf | title=Fortify-SHA-3-Report | url-status=dead | archiveurl=https://web.archive.org/web/20120222155656/http://blog.fortify.com/repo/Fortify-SHA-3-Report.pdf | archivedate=2012-02-22 }}

MD6 was submitted to the NIST SHA-3 competition. However, on July 1, 2009, Rivest posted a comment at NIST that MD6 is not yet ready to be a candidate for SHA-3 because of speed issues, a "gap in the proof that the submitted version of MD6 is resistant to differential attacks", and an inability to supply such a proof for a faster reduced-round version,{{cite web|url=http://groups.csail.mit.edu/cis/md6/OFFICIAL_COMMENT_MD6_2009-07-01.txt|title=OFFICIAL COMMENT: MD6|last=Rivest|first=Ronald|date=July 1, 2009|accessdate=September 27, 2011}} although Rivest also stated at the MD6 website that it is not withdrawn formally.{{cite web|url=http://www.schneier.com/blog/archives/2009/07/md6.html|title=MD6 Withdrawn from SHA-3 Competition|last=Schneier|first=Bruce|date=July 1, 2009|accessdate=July 9, 2009}} MD6 did not advance to the second round of the SHA-3 competition. In September 2011, a paper presenting an improved proof that MD6 and faster reduced-round versions are resistant to differential attacks{{cite web|url=http://eprint.iacr.org/2011/374|title=Restoring the Differential Resistance of MD6|last=Heilman|first=Ethan|date=July 10, 2011|accessdate=September 27, 2011}} was posted to the MD6 website.{{cite web|url=http://groups.csail.mit.edu/cis/md6/|title=Improved Differential Analysis|last=Heilman |first=Ethan|date=September 2011|accessdate=September 27, 2011}}