MDC-2

Let $E(p,k)$ be a block cipher encryption function with inputs $p$ (plaintext) and $k$ (key), each of length $n$, calculating a ciphertext of length also $n$.

For a given message $M$ to hash, the MDC-2 algorithm proceeds as follows. Let $A\_1,\; B\_1$ be two different constants of size $n$. Let $M\backslash ,\; ||\; \backslash ,\; \backslash text\{pad\}\; =\; M\_1\backslash ,||..||\backslash ,M\_m$ where each $M\_i$ has size $n$, then the hash $V\_m\; \backslash ,\; ||\; \backslash ,\; W\_m$ of the message is given by:

• for $i\; =\; 1$ to $m$:
• $V\_i\; =\; M\_i\; \backslash oplus\; E(M\_i,A\_i)$
• $W\_i\; =\; M\_i\; \backslash oplus\; E(M\_i,B\_i)$
• $V\_i^L\backslash ,\; ||\; \backslash ,V\_i^R\; =\; V\_i$
• $W\_i^L\backslash ,\; ||\; \backslash ,W\_i^R\; =\; W\_i$
• $A\_\{i+1\}\; =\; V\_i^L\backslash ,||\backslash ,W\_i^R$
• $B\_\{i+1\}\; =\; W\_i^L\backslash ,||\backslash ,V\_i^R$
• return $A\_\{m+1\}\backslash ,||\backslash ,B\_\{m+1\}$.

Here the $V\_i,\; W\_i$ are split in halves $V\_i^L$ etc., which have the length $n/2$.

When MDC-2 uses the DES block cipher, the 128-bit (16-byte) MDC-2 hashes are typically represented as 32-digit hexadecimal numbers. $A\_1$ is chosen as the 8-byte string 5252525252525252 and $B\_1$ is chosen as the 8-byte string 2525252525252525 (written as hexdigits). Additionally, before each iteration the first byte A[0] of $A$ recalculated as (A[0] & 0x9f) ^ 0x40 and the first byte B[0] of $B$ is recalculated as (B[0] & 0x9f) ^ 0x20.

The following demonstrates a 43-byte ASCII input (which is padded with five zero-bytes so its length is a multiple of the DES block size of 8 bytes) and the corresponding MDC-2 hash:

MDC2("The quick brown fox jumps over the lazy {{Background color|#87CEEB|d}}og")

= 000ed54e093d61679aefbeae05bfe33a

Even a small change in the message will (with probability) result in a completely different hash, e.g. changing d to c:

MDC2("The quick brown fox jumps over the lazy {{Background color|#87CEEB|c}}og")

= 775f59f8e51aec29c57ac6ab850d58e8

The hash of the zero-length string is:

MDC2("")

= 52525252525252522525252525252525

MDC-2 was covered by {{US patent|4908861}}, issued on March 13, 1990 but filed by IBM on August 28, 1987. Because of patent concerns support for MDC-2 has been disabled in OpenSSL on most Linux distributions and is not implemented by many other cryptographic libraries. It is implemented in GPG's libgcrypt.

The patent was due to expire on August 28, 2007, twenty years after the filing date. It actually expired in 2002{{Cite journal

| title = USPTO - Patent Maintenance Fees

| publisher = United States Patent Office

| date = March 13, 2002

| url = https://ramps.uspto.gov/eram/getMaintFeesInfo.do?patentNum=4908861&applicationNum=07090633

| access-date = 2008-01-31

}}{{Dead link|date=March 2020 |bot=InternetArchiveBot |fix-attempted=yes }} (Click on "Bibliographic data".) because IBM did not pay the renewal fee. The Canadian patent was not renewed and no European patent was granted so MDC-2 can now be freely used.

• One-way compression function

{{Cryptography navbox | hash}}

Category:Cryptographic hash functions