In this paper, we present the first cryptographic preimage attack on the full MD5 hash function. This attack, with a complexity of 2 116.9 , generates a pseudo-preimage of MD5 and, with a complexity of 2 123.4 , generates a preimage of MD5. The memory complexity of the attack is 2 45 × 11 words. Our attack is based on splice-and-cut and localcollision techniques that have been applied to step-reduced MD5 and other hash functions. We first generalize and improve these techniques so that they can

more »

... be more efficiently applied to many hash functions whose message expansions are a permutation of message-word order in each round. We then apply these techniques to MD5 and optimize the attack by considering the details of MD5 structure.