Difference Between MD4 and MD5 encryption

Question

During coding, I have used both MD4 and MD5 encryption techniques. But there hasn't been any noticeable security difference between either of them. And yet, most of them prefer MD5, in fact specify it. MD5 :

System.Text.UTF8Encoding UTF8 = new System.Text.UTF8Encoding();
MD5CryptoServiceProvider HashProvider = new MD5CryptoServiceProvider();

byte[] TDESKey = null;

TDESKey = HashProvider.ComputeHash(UTF8.GetBytes("CXPUB001"));  // ASYNC PRIVATE KEY CODE FOR DATA ENCRYPTION

//DATA ENCRYPTION 
TripleDESCryptoServiceProvider TDESAlgorithm = new TripleDESCryptoServiceProvider();
TDESAlgorithm.Key = TDESKey; //SENDER KEY APPENDED
TDESAlgorithm.Mode = CipherMode.ECB;
TDESAlgorithm.Padding = PaddingMode.PKCS7;
byte[] DataToEncrypt = UTF8.GetBytes(Message);

So, what is the difference, security wise, between using MD4 and MD5 ?

Answer 1

MD4 and MD5 are not encryption algorithms. They are one-way hash function designed for cryptography. It is important you understand the difference.

MD5 is a slightly modified version of MD4 that improves its security somewhat.

Another thing that is important to understand is that neither of these function are considered safe for use in cryptography: MD4 has been considered very insecure since the beginning of the 90's and MD5 is known to be insecure since the beginning of the 2000's.

Unless you really have to use these function for compatibility reasons, do not use them in your code, especially MD4.

If you can, use one of the SHA-2 variants (the .NET Framework implements all of them) or, if you can't, at least use SHA-1 temporarily, which is theoretically vulnerable but for which there is no practical attack yet. However, you need to understand that support for SHA-1 is going away in many systems pretty soon as well.

Answer 2

most of them prefer MD5, in fact specify it

Well, MD5 is merely an egregiously broken cryptographic hash function, whereas MD4 is a comically, egregiously mega-broken cryptographic hash function. (3DES is a bit broken too FWIW.)

However, in addition to the background in Stephane's answer:

TDESKey = HashProvider.ComputeHash(UTF8.GetBytes("CXPUB001"));

In your case the difference between MD4 and MD5 probably doesn't matter because it doesn't look like you are using the hash for cryptographic purposes. You're just using it as a utility key derivation function to get from a variable-length password to a fixed-width byte array suitable for use as key material.

In this case there would be no security measure being provided by the hash that might be compromised by the weakness of the hash. If you did want this to be a security measure (ie, you anticipate an attacker might have the TDESKey and you don't want them to be able to derive "CXPUB001" from it quickly) then you would need a much stronger/slower form of hash than either MD4 or MD5.

TDESAlgorithm.Mode = CipherMode.ECB;

Yeah, that doesn't sound promising, and neither does the apparent lack of signing. If this is a real application you should probably consider using some existing known-good cryptosystem instead. See the oft-quoted If You're Typing The Letters A-E-S Into Your Code..., whose “bad” example is almost exactly what you're doing.