MD6

Speeds in excess of 1 GB/s have been reported to be possible for long messages on 16-core CPU architecture.

In December 2008, Douglas Held of Fortify Software discovered a buffer overflow in the original MD6 hash algorithm's reference implementation. This error was later made public by Ron Rivest on 19 February 2009, with a release of a corrected reference implementation in advance of the Fortify Report.

MD6 was submitted to the NIST SHA-3 competition. However, on July 1, 2009, Rivest posted a comment at NIST that MD6 is not yet ready to be a candidate for SHA-3 because of speed issues, a "gap in the proof that the submitted version of MD6 is resistant to differential attacks", and an inability to supply such a proof for a faster reduced-round version, although Rivest also stated at the MD6 website that it is not withdrawn formally. MD6 did not advance to the second round of the SHA-3 competition. In September 2011, a paper presenting an improved proof that MD6 and faster reduced-round versions are resistant to differential attacks was posted to the MD6 website.

MD6 hash test vectors

MD6("The quick brown fox jumps over the lazy <span style="background-color: #87CEEB;color:black;" about="#mwt35" typeof="mw:Transclusion" data-mw='{"parts":[{"template":{"target":{"wt":"Background color","href":"./Template:Background_color"},"params":{"1":{"wt":"#87CEEB"},"2":{"wt":"d"}},"i":0}}]}' id="mwQg">d</span>og") = 977592608c45c9923340338450fdcccc21a68888e1e6350e133c5186cd9736ee

A change in even a single bit of the message will, with overwhelming probability, result in a completely different message digest due to the avalanche effect:

MD6("The quick brown fox jumps over the lazy <span style="background-color: #87CEEB;color:black;" about="#mwt36" typeof="mw:Transclusion" data-mw='{"parts":[{"template":{"target":{"wt":"Background color","href":"./Template:Background_color"},"params":{"1":{"wt":"#87CEEB"},"2":{"wt":"c"}},"i":0}}]}' id="mwRg">c</span>og") = 85fe717a5896a085a31be5d9457b4da75a6ebc003eded96d7cb0ff1737235bba

The Hash of the zero-length string is:

MD6("") = bca38b24a804aa37d821d31af00f5598230122c5bbfc4c4ad5ed40e4258f04ca