Every time you log into a Windows machine, an algorithm designed in 1990 runs silently in the background. That algorithm is MD4, and it's the cryptographic foundation of every NTLM hash stored in Windows.
MD4 is a fascinating piece of cryptographic history. It was designed by one of the most influential cryptographers of the 20th century, it was broken within five years of its publication, and yet it remains embedded in one of the most widely used operating systems on Earth. Let's take a deep dive into how MD4 works, why it's broken, and why Windows can't let it go.
Ronald Rivest and the Design of MD4
MD4 was designed by Ronald Rivest in 1990. Rivest is one of the most influential figures in cryptography — he's the "R" in RSA (the Rivest-Shamir-Adleman public key cryptosystem) and has designed multiple hash algorithms including MD2, MD4, MD5, and MD6.
The goal of MD4 was simple: create a fast, secure hash function that produces a 128-bit output from an arbitrary-length input. At the time, existing hash functions were either too slow for practical use or had known weaknesses. Rivest designed MD4 to be both fast and secure, with a focus on simplicity.
The design is elegant in its way. It takes a message of any length, pads it to a multiple of 512 bits, and processes it in 512-bit blocks through a compression function. The output is a 128-bit (16-byte) hash. The entire algorithm can be implemented in a few dozen lines of code.
How the Compression Function Works
MD4's compression function is where the real work happens. It takes a 128-bit chaining value (initialized to fixed constants) and a 512-bit message block, and produces a new 128-bit value. The process is repeated for each block of the message, with the output of one block becoming the input to the next. The final output is the hash.
Within each block, MD4 performs three rounds of operations:
**Round 1 (16 operations):** Uses bitwise operations (AND, OR, XOR) and rotations. Each operation combines one word of the message with the chaining value using a specific function. This round provides diffusion — spreading the influence of each input bit across the output.
**Round 2 (16 operations):** Introduces a different combining function that uses AND, OR, and NOT operations. This round adds more complexity and helps ensure that changes to the input produce very different outputs.
**Round 3 (16 operations):** Uses yet another combining function with XOR and AND operations. This round further mixes the state and provides additional resistance to differential attacks (though as we'll see, not enough).
Each operation in each round includes a rotation, which shifts bits circularly. These rotations are crucial for diffusion — they ensure that changes to any input bit affect many output bits.
The three rounds, 48 operations total, transform the 512-bit input block and 128-bit chaining value into a new 128-bit state. After all blocks are processed, the final state is the hash.
The design is fast. Very fast. On 1990s hardware, MD4 was significantly quicker than alternatives. On modern hardware, it's blazingly fast — which, as it turns out, is part of the problem.
The Collision Attacks
A hash function is supposed to be collision-resistant: it should be computationally infeasible to find two different inputs that produce the same hash. MD4 fails this requirement spectacularly.
The first crack appeared in 1995, just five years after MD4 was published. Hans Dobbertin, a cryptanalyst at the German Information Security Agency, found a method to produce MD4 collisions with significant but feasible computational effort. His attack exploited weaknesses in MD4's round structure, particularly the relatively simple combining functions and the limited number of rounds.
Over the following years, the attacks got better:
**1996:** Dobbertin published an improved attack that could find collisions with about 2^20 computations — feasible on a personal computer.
**2004:** Xiaoyun Wang and colleagues published a devastating attack that could find MD4 collisions in under a second on a standard PC. Their attack used differential cryptanalysis to find specific message pairs that would collide.
**2007:** Further research showed that not only could collisions be found instantly, but meaningful collisions could be constructed — pairs of documents with different content but the same MD4 hash.
Today, MD4 collisions can be found in milliseconds. The algorithm provides essentially zero collision resistance. Pre-image resistance (finding an input that produces a specific hash) is also weaker than expected, though not as thoroughly broken as collision resistance.
Why NTLM Still Uses MD4
Given that MD4 has been broken for decades, why does Windows still use it for NTLM hashes? The answer is a familiar one: backward compatibility.
When Microsoft designed NTLM in the early 1990s, MD4 was a reasonable choice. It was fast, it was considered secure at the time, and it was simple to implement. The NTLM hash format — UTF-16LE encoding followed by MD4 — was embedded into Windows NT and has been carried forward through every version of Windows since.
Changing the hash format would require: - Updating the SAM and NTDS.dit database formats - Re-hashing every password in every Windows domain - Updating every authentication protocol that uses the NTLM hash (NTLMv1, NTLMv2, Kerberos NTLM fallback) - Ensuring compatibility with third-party applications that rely on the NTLM hash format - Coordinating updates across billions of Windows installations worldwide
The cost and risk of such a change are enormous. Instead, Microsoft has taken a different approach: strengthen the protocols around the hash and gradually move away from NTLM authentication entirely.
NTLMv2, introduced in 1999, uses HMAC-MD5 instead of raw MD4 for the challenge-response computation, which is more resistant to attack. Kerberos, which uses stronger cryptography, is the preferred authentication protocol. And Microsoft has been adding NTLM restriction and auditing features to recent Windows versions.
But the stored hash remains MD4-based. When you generate an NTLM hash with our NTLM Hash Generator, you're computing MD4 of a UTF-16LE encoded string, just as Windows has done for 30 years.
What Broken MD4 Means for NTLM Security
The fact that MD4 is broken doesn't mean NTLM hashes are instantly reversible. Hash functions are one-way by design — you can't "decrypt" a hash. But the brokenness of MD4 has practical implications:
**Fast Computation:** MD4's speed means attackers can try billions of password guesses per second. A GPU-based cracking rig can compute hundreds of millions of MD4 hashes per second. This makes weak passwords crackable in seconds.
**No Salt:** NTLM doesn't salt the hash, so the same password always produces the same hash. Attackers can use pre-computed rainbow tables to look up hashes instantly without any computation at all.
**The Hash Is the Password (Almost):** In pass-the-hash attacks, the attacker doesn't even need to crack the hash. They use it directly for authentication. The brokenness of MD4 is irrelevant because the hash itself is the credential. Read more about this in our article on pass-the-hash attacks.
**Structural Weaknesses:** While collision attacks on MD4 don't directly help crack passwords, they demonstrate that the algorithm's structure is fundamentally flawed. This raises concerns about whether more sophisticated attacks could be developed that target the specific way NTLM uses MD4.
Modern Alternatives
If you're designing a password hashing system today, MD4 is the wrong choice. Modern password hashing uses algorithms specifically designed to be slow:
**bcrypt:** Uses the Blowfish cipher with a configurable cost factor. Each hash requires many iterations, making brute-force attacks expensive.
**scrypt:** Designed to be memory-hard, requiring significant RAM to compute. This makes GPU and ASIC attacks impractical.
**Argon2:** The winner of the Password Hashing Competition. It's memory-hard, resistant to side-channel attacks, and has tunable parameters for memory, time, and parallelism.
These algorithms also include salt by design, preventing rainbow table attacks. NTLM's use of unsalted MD4 is a stark contrast.
The Legacy of MD4
MD4's story is a reminder that cryptographic decisions have long-lasting consequences. An algorithm designed in 1990 for a world of limited computing power is still running on billions of devices today, not because it's good, but because changing it is hard.
Understanding MD4 helps you understand why NTLM hashes are vulnerable, why Windows password security has limitations, and why the security community has been pushing for alternatives for decades. It's not just historical curiosity — it's the foundation of how Windows stores your password right now.
For more on how this hash is used in practice, see our articles on NTLM hash explained and NTLM vs NTLMv2.
