3 ms·

There were certificates (including a root CA) using MD2 until recently. MD2 itself was only retired in 2011 [1]. https://www.rfc-editor.org/rfc/rfc6149.txt htt

• tptacek 13y ago
  You are obviously right. Now I feel dumb. I concede the importance of MD2. Do you believe that the starting state for MD2 is a possible backdoor? Later: I'm batting .000 today on this stuff; it's not the starting state of MD2 that he's talking about, of course, and the misapprehension that he was is part of why I was dismissive. Go me.
  • pbsd 13y ago
    It seems your edit did all the work for me. Being in the core of the MD2 compression function puts the Sbox in a good place to be a backdoor. However I strongly doubt this is one. The attacks that have broken MD2 do not seem to hinge terribly on the Sbox (I may be wrong, it was only a cursory look). It's more likely to me that the Sbox was generated using a hard-to-replicate Knuth shuffle using the digits of Pi.
• noclip 13y ago
  "were"