For other uses, see MD-6 (disambiguation) .
|Designers||Ronald Rivest, Benjamin Agre, Dan Bailey, Sarah Cheng, Christopher Crutchfield, Yevgeniy Dodis, Kermin Fleming, Asif Khan, Jayant Krishnamurthy, Yuncheng Lin, Leo Reyzin, Emily Shen, Jim Sukha, Eran Tromer, Yiqun Lisa Yin|
|Series||MD2 , MD4 ,MD5, MD6|
|Digest sizes||Variable, 0<d≤512 bits|
Variable. Default, Unkeyed=40+[d/4], Keyed=max(80,40+(d/4))
The MD6 Message-Digest Algorithm is a cryptographic hash function . It uses aMerkle tree-like structure to allow for immense parallel computation of hashes for very long inputs. Authors claim a performance of 28cycles per byte for MD6-256 on anIntel Core 2 Duo and provable resistance against differential cryptanalysis .Thesource code of the reference implementation was released underMIT license.
Speeds in excess of 1 GB/s have been reported to be possible for long messages on 16-core CPU architecture.
The design ofMerkle tree is based on the claims fromIntel describing the future of hardware processors with tens and thousands of cores instead of the conventional uni-core systems. With this in mind, Merkle tree hash structures exploit full potential of such hardware while being appropriate for current uni/dual core architectures.
In December 2008, Douglas Held ofFortify Software discovered abuffer overflow in the original MD6 hash algorithm’s reference implementation. This error was later made public byRon Rivest on 19 February 2009, with a release of a corrected reference implementation in advance of the Fortify Report.
MD6 was submitted to the NIST SHA-3 competition . However, on July 1, 2009, Rivest posted a comment at NIST that MD6 is not yet ready to be a candidate for SHA-3 because of speed issues, a "gap in the proof that the submitted version of MD6 is resistant to differential attacks", and an inability to supply such a proof for a faster reduced-round version,although Rivest also stated at the MD6 website that it is not withdrawn formally.MD6 did not advance to the second round of the SHA-3 competition. In September 2011, a paper presenting an improved proof that MD6 and faster reduced-round versions are resistant to differential attackswas posted to the MD6 website.
The algorithm’s first known production use was in theConficker.B worm in December 2008;the worm’s authors subsequently updated Conficker with the corrected implementation once the buffer overflow vulnerability became known.