The First Two Rounds of MD4 are Not One-Way

In [1] it was shown that there are very effective attacks leading to collisions for the hash function MD4 designed by R. Rivest [3]. A summary of the status of hash functions of the MD4-family with respect to collision-resistence can be found in [2] and [4]. However, attacking the one-wayness of a hash function is a much more demanding challenge, and in case of success it has much more devastating consequences. No result along this line is known for MD4 and its successors. Therefore it is worth to explore how the recently developed new analytic methods for finding collisions can be applied to construct preimages or second preimages. As a first step, we state here the following partial result: Denote by MD4 the reduced version of MD4, where the third round of its underlying three-round compression function is cancelled, but everything else of its specification is kept (e.g. initial value, padding rule).