Summary

  • RFC 1186 reported MD4 speeds of 1,450,000 bytes a second on a Sun SPARC, about 70,000 on a DEC MicroVAX II and about 32,000 on a 20 MHz 80286. Its collision-resistance estimate was expressly a conjecture.
  • RFC 1320 replaced the 1990 document in 1992 with a more portable reference implementation. RFC 6150 moved MD4 to Historic in 2011 after documented attacks had made its collision promise untenable.

The October 1990 MD4 specification put a stopwatch beside a wager. Ronald Rivest's RFC 1186 described a compact program that turned a message of arbitrary length into a 128-bit digest. A signer could digest a large file before applying an RSA signature. The attraction was practical: fewer bytes to process at the expensive signing step, with one short fingerprint meant to stand for the whole file.

The RFC named the machines on which MD4 had run. A Sun SPARC processed 1,450,000 bytes per second. A DEC MicroVAX II managed approximately 70,000; a 20 MHz 80286, approximately 32,000. Those are three reported implementation results, each tied to a particular machine. The document also noted that the algorithm needed no large substitution tables and could fit in compact code. Someone deciding whether to implement MD4 had more than an adjective like “fast.” They had numbers and a C program to inspect.

The security side had no stopwatch. The RFC called it a conjecture that finding two messages with the same digest would take roughly 2^64 operations and finding a message for a specified digest roughly 2^128. It also said the new algorithm merited further analysis. That wording mattered: an implementation benchmark observes what this code did on this hardware; a collision estimate predicts what an adversary cannot do with methods not yet found. A fast digest and a hard-to-forge digest answer separate questions.

The publication made the first question unusually easy to inspect. It specified 32-bit words, 512-bit blocks, padding and the encoding of the original message length. Its appendix supplied a C interface, implementation, driver and sample run. Rivest put MD4 in the public domain for review and possible adoption as a standard. The 1990 memo was informational; it did not declare an Internet standard. The code was ready to run while the security argument was still open to attack.

Two years later, RFC 1320 replaced RFC 1186. It called a more portable reference implementation the main difference. It also documented an object identifier and parameter convention for OSI applications. The public contract had become easier to carry between systems. Portability could widen use; it could not turn a conjecture into a proof. RFC 1320 kept the proposal's informational status and its invitation to scrutiny.

The scrutiny produced a very different set of numbers. RFC 6150, the March 2011 retirement record, recounts a 1996 practical collision attack estimated at 2^20 MD4 computations and a 2004 result at 2^8. The gap between the original 2^64 conjecture and those later results was not a rounding error. It changed what the fingerprint could safely promise when two different messages might be deliberately made to match.

The IETF moved RFC 1320 to Historic status and recommended deprecating MD4 in favor of existing alternatives such as SHA-256. The retirement document also traced residual uses, including a Microsoft compatibility path, and said withdrawing deployed cryptography takes years. A status change marks a decision in the standards record; software and counterparties still need migration work. The 1990 RFC had published runnable code and a claim to be tested. The 2011 RFC published the outcome of that test and the cost of living with old choices.

Sources