Constructing a Set of Weak Values for Full-round MD4 Hash Function.

In this paper we describe the construction of a set of full-round MD4 compression function values, which are weak against the preimage attack of a special kind. The cardinality estimation for this set, obtained by using an effective probabilistic algorithm, is close to 232. According to this, the fraction of weak outputs in the set of all outputs of the MD4 compression function is about $2^{-96}$. Thus, the probability to obtain an easyinvertible output by choosing a random input is significantly higher than $2^{-128}$. These results demonstrate that the full-round MD4 compression function does not have the properties of a random oracle.