Movatterモバイル変換

[0]ホーム

Jump to content

Whirlpool (hash function)

Edit links

From Wikipedia, the free encyclopedia

Cryptographic hash function

"WHIRLPOOL" redirects here. For other uses, seeWhirlpool (disambiguation).

Whirlpool
General
Designers	Vincent Rijmen,Paulo S. L. M. Barreto
First published	2000, 2001, 2003
Derived from	Square,AES
Certification	NESSIE
Detail
Digest sizes	512 bits
Security claims	Large hashsum size
Structure	Miyaguchi-Preneel
Rounds	10
Best publiccryptanalysis
In 2009, arebound attack was announced that presents full collisions against 4.5 rounds of Whirlpool in 2¹²⁰ operations, semi-free-start collisions against 5.5 rounds in 2¹²⁰ time and semi-free-start near-collisions against 7.5 rounds in 2¹²⁸ time.^[1]

Incomputer science andcryptography,Whirlpool (sometimes styledWHIRLPOOL) is acryptographic hash function. It was designed byVincent Rijmen (co-creator of theAdvanced Encryption Standard) andPaulo S. L. M. Barreto, who first described it in 2000. It is named after theWhirlpool galaxy inCanes Venatici (M51, orNGC 5194), the first one recognized to have a spiral structure byWilliam Parsons, third Earl of Rosse, in April 1845^[1].

The hash has been recommended by theNESSIE project. It has also been adopted by theInternational Organization for Standardization (ISO) and theInternational Electrotechnical Commission (IEC) as part of the joint ISO/IEC 10118-3international standard.

Design features

[edit]

TheWhirlpool Galaxy (M51), which inspired the name of the algorithm.^[2]

Whirlpool is a hash designed after theSquare block cipher, and is considered to be in that family of block cipher functions.

Whirlpool is aMiyaguchi–Preneel construction based on a substantially modifiedAdvanced Encryption Standard (AES).

Whirlpool takes a message of any length less than 2²⁵⁶ bits and returns a 512-bitmessage digest.^[3]

The authors have declared that

"WHIRLPOOL is not (and will never be)patented. It may be used free of charge for any purpose."^[2]

Version changes

[edit]

The original Whirlpool will be calledWhirlpool-0, the first revision of Whirlpool will be calledWhirlpool-T and the latest version will be calledWhirlpool in the following test vectors.

In the first revision in 2001, theS-box was changed from a randomly generated one with good cryptographic properties to one which has better cryptographic properties and is easier to implement in hardware.
In the second revision (2003), a flaw in thediffusion matrix was found that lowered the estimated security of the algorithm below its potential.^[4] Changing the 8x8 rotating matrix constants from (1, 1, 3, 1, 5, 8, 9, 5) to (1, 1, 4, 1, 8, 5, 2, 9) solved this issue.

Internal structure

[edit]

The Whirlpool hash function is aMerkle–Damgård construction based on anAES-likeblock cipher W inMiyaguchi–Preneel mode.^[2]

Theblock cipher $W {\displaystyle W}$ consists of an 8×8 state matrix $S {\displaystyle S}$ of bytes, for a total of 512 bits.

The encryption process consists of updating the state with four round functions over 10 rounds. The four round functions are SubBytes (SB or $\gamma$ ), ShiftColumns (SC or $\pi$ ), MixRows (MR or $\theta$ ) and AddRoundKey (AK or $\sigma [k]$ ). During each round the new state is computed as $S:=\left(AK\circ MR\circ SC\circ SB\right)(S)$ .

SubBytes

[edit]

TheSubBytes operation applies a non-linear permutation (the S-box) to each byte of the state independently. The 8-bit S-box is composed of 3 smaller 4-bit S-boxes.

ShiftColumns

[edit]

TheShiftColumns operation cyclically shifts each byte in each column of the state. Columnj has its bytes shifted downwards byj positions.

MixBytesInRows

[edit]

TheMixBytesInRows operation is a right-multiplication of each row by an 8×8matrix over $GF({2^{8}})$ . The matrix is chosen such that thebranch number (an important property when looking at resistance todifferential cryptanalysis) is 9, which is maximal.

AddRoundKey

[edit]

TheAddRoundKey operation uses bitwisexor to add a key calculated by the key schedule to the current state. The key schedule is identical to the encryption itself, except the AddRoundKey function is replaced by anAddRoundConstant function that adds a predetermined constant in each round.

Complete process of the Whirlpool algorithm

[edit]

Here is the detailed explanation of the Whirlpoolalgorithm as described in the official release paper^[1].

First, let's define thenotation used:

Every number used is an 8-bit (1byte) integer.
$\{0,1\}^{n}$ is an-bitbinary string.
${\mathcal {M}}_{n\times m}$ is ann-by-mmatrix ofbytes.
$f:A\to B$ is a function thatmaps elements fromset A toset B.
$a\oplus b$ is the bitwiseXOR of $a {\displaystyle a}$ and $b {\displaystyle b}$ .
If $a {\displaystyle a}$ and $b {\displaystyle b}$ arematrices, theXOR is applied element-wise ( $a\oplus b=c\ \Leftrightarrow \ c_{i,j}=a_{i,j}\oplus b_{i,j}$ ).
$f\circ g$ is the composition function of $f {\displaystyle f}$ and $g {\displaystyle g}$ such that $\left(f\circ g\right)\left(x\right)=g\left(f\left(x\right)\right)$ ;
${\underset {k=m}{\overset {n}{\bigcirc }}}\alpha _{k},\ \forall \left(m;n;k\right)\in \mathbb {Z} ^{3},\ m\leq k\leq n$ is the ascending repetition of $\alpha _{m}\circ \alpha _{m+1}\circ \ldots \circ \alpha _{n-1}\circ \alpha _{n}$ ;
${\underset {m}{\overset {k=n}{\bigcirc }}}\alpha _{k},\ \forall \left(m;n;k\right)\in \mathbb {Z} ^{3},\ m\leq k\leq n$ is the descending repetition of $\alpha _{n}\circ \alpha _{n-1}\circ \ldots \circ \alpha _{m+1}\circ \alpha _{m}$ .

Whirlpool algorithm

[edit]

The message $M {\displaystyle M}$ that is to be hashed is firstpadded to ensure its length is a multiple of the block size (512 bits). This is done using the standardpadding scheme defined in theISO/IEC 10118-1 standard (the same used formd5,sha-2, and others):

Append a '1' bit;
Append as many '0' bits as needed for the length to reach a multiple of 256 ( $512-256$ );
Append the original length of the message in bits using 256-bitbig-endian format.

Then, the padded message is divided into $t {\displaystyle t}$ 512-bit blocks $m_{i}$ , $1\leq i\leq t$ .

Whirlpool iterates theMiyaguchi-Preneel hashing scheme over these blocks^{[sections 3.11 and 3.12]}^[1]:

${\begin{aligned}&{\begin{aligned}\eta _{i}&=\mu \left(m_{i}\right),\\H_{0}&=\mu \left(IV\right),\\H_{i}&=W\left[H_{i-1}\right]\left(\eta _{i}\right)\oplus H_{i-1}\oplus \eta _{i},\ 1\leq i\leq t\\\end{aligned}}\\&{\text{Whirlpool}}\left(M\right)\equiv \mu ^{-1}\left(H_{t}\right)\end{aligned}}$

Where:

$\mu :\{0,1\}^{512}\to {\mathcal {M}}_{8\times 8}$ is thestring tomatrix conversion function;
$\mu ^{-1}:{\mathcal {M}}_{8\times 8}\to \{0,1\}^{512}$ is thematrix tostring conversion function;
$I V {\displaystyle IV}$ is theinitialization vector, astring of 512 0-bits;
$W {\displaystyle W}$ is the Whirlpool cipher function.

Cipher W

[edit]

The internal block cipher function $W\left[{\mathcal {M}}_{8\times 8}\right]:{\mathcal {M}}_{8\times 8}\to {\mathcal {M}}_{8\times 8}$ ^{[section 3.9]}^[1] operates on and returns an 8x8matrix:

${\begin{aligned}W\left[K\right]=\left({\underset {1}{\overset {r=R}{\bigcirc }}}\rho \left[K_{r}\right]\right)\circ \sigma \left[K_{0}\right]\end{aligned}}$

Where:

$R {\displaystyle R}$ is the number of rounds (the standard Whirlpool uses $R=10$ );
$K_{n}$ is thenth key of the $K {\displaystyle K}$ key schedule;
$\rho$ is the round function.

The key schedule expands the key $K\in {\mathcal {M}}_{8\times 8}$ into asequence of keys $K_{r}\in {\mathcal {M}}_{8\times 8},\ 0\leq r\leq R$ ^{[section 3.8]}^[1]:

${\begin{aligned}K_{0}&=K,\\K_{r}&=\rho \left[c^{r}\right]\left(K_{r-1}\right),\ 1\leq r\leq R\\\end{aligned}}$

Where:

$c^{r}\in {\mathcal {M}}_{8\times 8}$ is therth round constantmatrix.

The round constant for therth round, $r>0$ , is amatrix $c^{r}\in {\mathcal {M}}_{8\times 8}$ , defined as:

${\begin{aligned}c_{0,j}^{r}&=S\left[8\left(r-1\right)+j\right],&0\leq j<8\\c_{i,j}^{r}&=0,&1\leq i<8,0\leq j<8\\\end{aligned}}$

Where:

$S\in {\mathcal {M}}_{16\times 16}$ is the S-box.

Round function ρ

[edit]

The round function $\rho \left[{\mathcal {M}}_{8\times 8}\right]:{\mathcal {M}}_{8\times 8}\to {\mathcal {M}}_{8\times 8}$ ^{[section 3.7]}^[1] is defined as:

${\begin{aligned}\rho \left[k\right]&=\sigma \left[k\right]\circ \theta \circ \pi \circ \gamma \\&_{\left(=\ AK\ \circ \ MR\ \circ \ SC\ \circ \ SB\right)}\\\end{aligned}}$

Where:

$\gamma$ is the non-linear layer;
$\pi$ is the cyclicalpermutation;
$\theta$ is the diffusion layer;
$\sigma$ is the key addition.

Non-linear layer γ (SubBytes)

[edit]

The function $\gamma :{\mathcal {M}}_{8\times 8}\to {\mathcal {M}}_{8\times 8}$ consists of the parallel application of a non-linearsubstitution $\psi :x_{\text{(Byte)}}\to S\left[x\right]_{\text{(Byte)}}$ to eachbytes of the argument independently^{[section 3.2]}^[1]:

${\begin{aligned}\gamma \left(a\right)=b\ \Leftrightarrow \ b_{i,j}=S\left[a_{i,j}\right],\ 0\leq i<8,\ 0\leq j<8,\\\end{aligned}}$

Cyclical permutation π (ShiftColumns)

[edit]

Thepermutation $\pi :{\mathcal {M}}_{8\times 8}\to {\mathcal {M}}_{8\times 8}$ cyclically shifts each column of its argument independently, so that column $j {\displaystyle j}$ is shifted downwards by $j {\displaystyle j}$ positions^{[section 3.3]}^[1]:

${\begin{aligned}\pi \left(a\right)=b\ \Leftrightarrow \ b_{i,j}=a_{\left(\left(i-j\right)\ {\text{mod}}\ 8\right),\ j},\ 0\leq i<8,\ 0\leq j<8\\\end{aligned}}$

Diffusion layer θ (MixBytesInRows)

[edit]

The linear diffusion layer $\theta :{\mathcal {M}}_{8\times 8}\to {\mathcal {M}}_{8\times 8}$ is a linearmapping based on thecircular matrix $C={\text{cir}}\left(01_{(16)},01_{(16)},04_{(16)},01_{(16)},08_{(16)},05_{(16)},02_{(16)},09_{(16)}\right)$ ^{[section 3.4]}^[1]:

${\begin{aligned}\theta \left(a\right)=a\cdot C,\ 0\leq i<8,\ 0\leq j<8\\\end{aligned}}$

Acirculant matrix $C\in {\mathcal {M}}_{n\times n}$ is defined as a matrix where each row is a cyclic shift of the previous row^{[section 2.2]}^[1]. Formally, acirculant matrix can be represented as:

${\begin{aligned}&{\text{cir}}(a_{0},a_{1},\ldots ,a_{n-1})={\begin{pmatrix}a_{0}&a_{1}&a_{2}&\cdots &a_{n-1}\\a_{n-1}&a_{0}&a_{1}&\cdots &a_{n-2}\\a_{n-2}&a_{n-1}&a_{0}&\cdots &a_{n-3}\\\vdots &\vdots &\vdots &\ddots &\vdots \\a_{1}&a_{2}&a_{3}&\cdots &a_{0}\\\end{pmatrix}},\ \forall a_{n}\in \mathbb {F} _{2^{8}},\ n\in \mathbb {N} \\&{\text{or simply}}\\&{\text{cir}}(a_{0},a_{1},\ldots ,a_{n-1})=c\ \Leftrightarrow \ c_{i,j}=a_{\left(i-j\right)\ {\text{mod}}\ 8},\ 0\leq i<8,\ 0\leq j<8,\ \forall a_{n}\in \mathbb {F} _{2^{8}},\ n\in \mathbb {N} \\\end{aligned}}$

For example,circulant matrix $C={\text{cir}}\left(01_{(16)},01_{(16)},04_{(16)},01_{(16)},08_{(16)},05_{(16)},02_{(16)},09_{(16)}\right)$ is thematrix:

${\begin{aligned}C={\begin{pmatrix}01_{(16)}&01_{(16)}&04_{(16)}&01_{(16)}&08_{(16)}&05_{(16)}&02_{(16)}&09_{(16)}\\09_{(16)}&01_{(16)}&01_{(16)}&04_{(16)}&01_{(16)}&08_{(16)}&05_{(16)}&02_{(16)}\\02_{(16)}&09_{(16)}&01_{(16)}&01_{(16)}&04_{(16)}&01_{(16)}&08_{(16)}&05_{(16)}\\05_{(16)}&02_{(16)}&09_{(16)}&01_{(16)}&01_{(16)}&04_{(16)}&01_{(16)}&08_{(16)}\\08_{(16)}&05_{(16)}&02_{(16)}&09_{(16)}&01_{(16)}&01_{(16)}&04_{(16)}&01_{(16)}\\01_{(16)}&08_{(16)}&05_{(16)}&02_{(16)}&09_{(16)}&01_{(16)}&01_{(16)}&04_{(16)}\\04_{(16)}&01_{(16)}&08_{(16)}&05_{(16)}&02_{(16)}&09_{(16)}&01_{(16)}&01_{(16)}\\01_{(16)}&04_{(16)}&01_{(16)}&08_{(16)}&05_{(16)}&02_{(16)}&09_{(16)}&01_{(16)}\\\end{pmatrix}}\\\end{aligned}}$

Key addition σ (AddRoundKey)

[edit]

The affine key addition $\sigma \left[{\mathcal {M}}_{8\times 8}\right]:{\mathcal {M}}_{8\times 8}\to {\mathcal {M}}_{8\times 8}$ consists of the bitwiseXOR of a keymatrix $k\in {\mathcal {K}}_{8\times 8}$ :

${\begin{aligned}\sigma \left[k\right]\left(a\right)=a\oplus k\\\end{aligned}}$

Substitution box S (S-Box)

[edit]

The S-Box $S\in {\mathcal {M}}_{16\times 16}$ is typically represented as alookup table, where each inputbyte is mapped to a corresponding outputbyte. It can be computed using optimal diffusion mapping generation techniques^{[section 2.4]}^[1] but here is amatrix representation of it: ${\begin{aligned}&S={\begin{pmatrix}18_{(16)}&23_{(16)}&c6_{(16)}&e8_{(16)}&87_{(16)}&b8_{(16)}&01_{(16)}&4f_{(16)}&36_{(16)}&a6_{(16)}&d2_{(16)}&f5_{(16)}&79_{(16)}&6f_{(16)}&91_{(16)}&52_{(16)}\\60_{(16)}&bc_{(16)}&9b_{(16)}&8e_{(16)}&a3_{(16)}&0c_{(16)}&7b_{(16)}&35_{(16)}&1d_{(16)}&e0_{(16)}&d7_{(16)}&c2_{(16)}&2e_{(16)}&4b_{(16)}&fe_{(16)}&57_{(16)}\\15_{(16)}&77_{(16)}&37_{(16)}&e5_{(16)}&9f_{(16)}&f0_{(16)}&4a_{(16)}&da_{(16)}&58_{(16)}&c9_{(16)}&29_{(16)}&0a_{(16)}&b1_{(16)}&a0_{(16)}&6b_{(16)}&85_{(16)}\\bd_{(16)}&5d_{(16)}&10_{(16)}&f4_{(16)}&cb_{(16)}&3e_{(16)}&05_{(16)}&67_{(16)}&e4_{(16)}&27_{(16)}&41_{(16)}&8b_{(16)}&a7_{(16)}&7d_{(16)}&95_{(16)}&d8_{(16)}\\fb_{(16)}&ee_{(16)}&7c_{(16)}&66_{(16)}&dd_{(16)}&17_{(16)}&47_{(16)}&9e_{(16)}&ca_{(16)}&2d_{(16)}&bf_{(16)}&07_{(16)}&ad_{(16)}&5a_{(16)}&83_{(16)}&33_{(16)}\\63_{(16)}&02_{(16)}&aa_{(16)}&71_{(16)}&c8_{(16)}&19_{(16)}&49_{(16)}&d9_{(16)}&f2_{(16)}&e3_{(16)}&5b_{(16)}&88_{(16)}&9a_{(16)}&26_{(16)}&32_{(16)}&b0_{(16)}\\e9_{(16)}&0f_{(16)}&d5_{(16)}&80_{(16)}&be_{(16)}&cd_{(16)}&34_{(16)}&48_{(16)}&ff_{(16)}&7a_{(16)}&90_{(16)}&5f_{(16)}&20_{(16)}&68_{(16)}&1a_{(16)}&ae_{(16)}\\b4_{(16)}&54_{(16)}&93_{(16)}&22_{(16)}&64_{(16)}&f1_{(16)}&73_{(16)}&12_{(16)}&40_{(16)}&08_{(16)}&c3_{(16)}&ec_{(16)}&db_{(16)}&a1_{(16)}&8d_{(16)}&3d_{(16)}\\97_{(16)}&00_{(16)}&cf_{(16)}&2b_{(16)}&76_{(16)}&82_{(16)}&d6_{(16)}&1b_{(16)}&b5_{(16)}&af_{(16)}&6a_{(16)}&50_{(16)}&45_{(16)}&f3_{(16)}&30_{(16)}&ef_{(16)}\\3f_{(16)}&55_{(16)}&a2_{(16)}&ea_{(16)}&65_{(16)}&ba_{(16)}&2f_{(16)}&c0_{(16)}&de_{(16)}&1c_{(16)}&fd_{(16)}&4d_{(16)}&92_{(16)}&75_{(16)}&06_{(16)}&8a_{(16)}\\b2_{(16)}&e6_{(16)}&0e_{(16)}&1f_{(16)}&62_{(16)}&d4_{(16)}&a8_{(16)}&96_{(16)}&f9_{(16)}&c5_{(16)}&25_{(16)}&59_{(16)}&84_{(16)}&72_{(16)}&39_{(16)}&4c_{(16)}\\5e_{(16)}&78_{(16)}&38_{(16)}&8c_{(16)}&d1_{(16)}&a5_{(16)}&e2_{(16)}&61_{(16)}&b3_{(16)}&21_{(16)}&9c_{(16)}&1e_{(16)}&43_{(16)}&c7_{(16)}&fc_{(16)}&04_{(16)}\\51_{(16)}&99_{(16)}&6d_{(16)}&0d_{(16)}&fa_{(16)}&df_{(16)}&7e_{(16)}&24_{(16)}&3b_{(16)}&ab_{(16)}&ce_{(16)}&11_{(16)}&8f_{(16)}&4e_{(16)}&b7_{(16)}&eb_{(16)}\\3c_{(16)}&81_{(16)}&94_{(16)}&f7_{(16)}&b9_{(16)}&13_{(16)}&2c_{(16)}&d3_{(16)}&e7_{(16)}&6e_{(16)}&c4_{(16)}&03_{(16)}&56_{(16)}&44_{(16)}&7f_{(16)}&a9_{(16)}\\2a_{(16)}&bb_{(16)}&c1_{(16)}&53_{(16)}&dc_{(16)}&0b_{(16)}&9d_{(16)}&6c_{(16)}&31_{(16)}&74_{(16)}&f6_{(16)}&46_{(16)}&ac_{(16)}&89_{(16)}&14_{(16)}&e1_{(16)}\\16_{(16)}&3a_{(16)}&69_{(16)}&09_{(16)}&70_{(16)}&b6_{(16)}&d0_{(16)}&ed_{(16)}&cc_{(16)}&42_{(16)}&98_{(16)}&a4_{(16)}&28_{(16)}&5c_{(16)}&f8_{(16)}&86_{(16)}\\\end{pmatrix}}\\\end{aligned}}$

Whirlpool hashes

[edit]

The Whirlpool algorithm has undergone two revisions since its original 2000 specification.

People incorporating Whirlpool will most likely use the most recent revision of Whirlpool; while there are no known security weaknesses in earlier versions of Whirlpool, the most recent revision has better hardware implementation efficiency characteristics, and is also likely to be more secure. As mentioned earlier, it is also the version adopted in the ISO/IEC 10118-3international standard.

The 512-bit (64-byte) Whirlpool hashes (also termedmessage digests) are typically represented as 128-digithexadecimal numbers.
The following demonstrates a 43-byteASCII input (not including quotes) and the corresponding Whirlpool hashes:

Version	Input String	Computed Hash
Whirlpool-0	"The quick brown fox jumps over the lazy dog"	4F8F5CB531E3D49A61CF417CD133792CCFA501FD8DA53EE368FED20E5FE0248C 3A0B64F98A6533CEE1DA614C3A8DDEC791FF05FEE6D971D57C1348320F4EB42D
Whirlpool-T	"The quick brown fox jumps over the lazy dog"	3CCF8252D8BBB258460D9AA999C06EE38E67CB546CFFCF48E91F700F6FC7C183 AC8CC3D3096DD30A35B01F4620A1E3A20D79CD5168544D9E1B7CDF49970E87F1
Whirlpool	"The quick brown fox jumps over the lazy dog"	B97DE512E91E3828B40D2B0FDCE9CEB3C4A71F9BEA8D88E75C4FA854DF36725F D2B52EB6544EDCACD6F8BEDDFEA403CB55AE31F03AD62A5EF54E42EE82C3FB35

Version

Input String

Computed Hash

Whirlpool-0

"The quick brown fox jumps over the lazy dog"

 4F8F5CB531E3D49A61CF417CD133792CCFA501FD8DA53EE368FED20E5FE0248C 3A0B64F98A6533CEE1DA614C3A8DDEC791FF05FEE6D971D57C1348320F4EB42D

Whirlpool-T

"The quick brown fox jumps over the lazy dog"

 3CCF8252D8BBB258460D9AA999C06EE38E67CB546CFFCF48E91F700F6FC7C183 AC8CC3D3096DD30A35B01F4620A1E3A20D79CD5168544D9E1B7CDF49970E87F1

Whirlpool

"The quick brown fox jumps over the lazy dog"

 B97DE512E91E3828B40D2B0FDCE9CEB3C4A71F9BEA8D88E75C4FA854DF36725F D2B52EB6544EDCACD6F8BEDDFEA403CB55AE31F03AD62A5EF54E42EE82C3FB35

Implementations

[edit]

The authors providereference implementations of the Whirlpool algorithm, including a version written inC and a version written inJava.^[2] These reference implementations have been released into the public domain.^[2]

Research on the security analysis of the Whirlpool function however, has revealed that on average, the introduction of 8 random faults is sufficient to compromise the 512-bit Whirlpool hash message being processed and the secret key of HMAC-Whirlpool within the context of Cloud of Things (CoTs). This emphasizes the need for increased security measures in its implementation.^[5]

Pseudo-code

[edit]

Here is an implementation example of the standard Whirlpoolalgorithm:

S :=  0x18, 0x23, 0xc6, 0xe8, 0x87, 0xb8, 0x01, 0x4f, 0x36, 0xa6, 0xd2, 0xf5, 0x79, 0x6f, 0x91, 0x52, \      0x60, 0xbc, 0x9b, 0x8e, 0xa3, 0x0c, 0x7b, 0x35, 0x1d, 0xe0, 0xd7, 0xc2, 0x2e, 0x4b, 0xfe, 0x57, \      0x15, 0x77, 0x37, 0xe5, 0x9f, 0xf0, 0x4a, 0xda, 0x58, 0xc9, 0x29, 0x0a, 0xb1, 0xa0, 0x6b, 0x85, \      0xbd, 0x5d, 0x10, 0xf4, 0xcb, 0x3e, 0x05, 0x67, 0xe4, 0x27, 0x41, 0x8b, 0xa7, 0x7d, 0x95, 0xd8, \      0xfb, 0xee, 0x7c, 0x66, 0xdd, 0x17, 0x47, 0x9e, 0xca, 0x2d, 0xbf, 0x07, 0xad, 0x5a, 0x83, 0x33, \      0x63, 0x02, 0xaa, 0x71, 0xc8, 0x19, 0x49, 0xd9, 0xf2, 0xe3, 0x5b, 0x88, 0x9a, 0x26, 0x32, 0xb0, \      0xe9, 0x0f, 0xd5, 0x80, 0xbe, 0xcd, 0x34, 0x48, 0xff, 0x7a, 0x90, 0x5f, 0x20, 0x68, 0x1a, 0xae, \      0xb4, 0x54, 0x93, 0x22, 0x64, 0xf1, 0x73, 0x12, 0x40, 0x08, 0xc3, 0xec, 0xdb, 0xa1, 0x8d, 0x3d, \      0x97, 0x00, 0xcf, 0x2b, 0x76, 0x82, 0xd6, 0x1b, 0xb5, 0xaf, 0x6a, 0x50, 0x45, 0xf3, 0x30, 0xef, \      0x3f, 0x55, 0xa2, 0xea, 0x65, 0xba, 0x2f, 0xc0, 0xde, 0x1c, 0xfd, 0x4d, 0x92, 0x75, 0x06, 0x8a, \      0xb2, 0xe6, 0x0e, 0x1f, 0x62, 0xd4, 0xa8, 0x96, 0xf9, 0xc5, 0x25, 0x59, 0x84, 0x72, 0x39, 0x4c, \      0x5e, 0x78, 0x38, 0x8c, 0xd1, 0xa5, 0xe2, 0x61, 0xb3, 0x21, 0x9c, 0x1e, 0x43, 0xc7, 0xfc, 0x04, \      0x51, 0x99, 0x6d, 0x0d, 0xfa, 0xdf, 0x7e, 0x24, 0x3b, 0xab, 0xce, 0x11, 0x8f, 0x4e, 0xb7, 0xeb, \      0x3c, 0x81, 0x94, 0xf7, 0xb9, 0x13, 0x2c, 0xd3, 0xe7, 0x6e, 0xc4, 0x03, 0x56, 0x44, 0x7f, 0xa9, \      0x2a, 0xbb, 0xc1, 0x53, 0xdc, 0x0b, 0x9d, 0x6c, 0x31, 0x74, 0xf6, 0x46, 0xac, 0x89, 0x14, 0xe1, \      0x16, 0x3a, 0x69, 0x09, 0x70, 0xb6, 0xd0, 0xed, 0xcc, 0x42, 0x98, 0xa4, 0x28, 0x5c, 0xf8, 0x86C :=  0x01, 0x01, 0x04, 0x01, 0x08, 0x05, 0x02, 0x09, \      0x09, 0x01, 0x01, 0x04, 0x01, 0x08, 0x05, 0x02, \      0x02, 0x09, 0x01, 0x01, 0x04, 0x01, 0x08, 0x05, \      0x05, 0x02, 0x09, 0x01, 0x01, 0x04, 0x01, 0x08, \      0x08, 0x05, 0x02, 0x09, 0x01, 0x01, 0x04, 0x01, \      0x01, 0x08, 0x05, 0x02, 0x09, 0x01, 0x01, 0x04, \      0x04, 0x01, 0x08, 0x05, 0x02, 0x09, 0x01, 0x01, \      0x01, 0x04, 0x01, 0x08, 0x05, 0x02, 0x09, 0x01# Matrix built from initialization vectorIM := 0, 0, 0, 0, 0, 0, 0, 0, \      0, 0, 0, 0, 0, 0, 0, 0, \      0, 0, 0, 0, 0, 0, 0, 0, \      0, 0, 0, 0, 0, 0, 0, 0, \      0, 0, 0, 0, 0, 0, 0, 0, \      0, 0, 0, 0, 0, 0, 0, 0, \      0, 0, 0, 0, 0, 0, 0, 0, \      0, 0, 0, 0, 0, 0, 0, 0R :=  10func getConstantRoundMatrix(r)    cr := IM    for j from 0 to 7        cr[j] := S[8 * (r - 1) + j]    endfor    return crendfuncfunc whirlpoolRound(matrix, key)    # Apply the non-linear transformation γ    for i from 0 to 7        for j from 0 to 7            matrix[i * 8 + j] = S[matrix[i * 8 + j]]        endfor    endfor    # Apply cyclical permutation π    tmp := matrix    for i from 0 to 7        for j from 0 to 7            # '+ 8' to prevent negative indices            matrix[i * 8 + j] = tmp[((i - j + 8) % 8) * 8 + j]        endfor    endfor    matrix := tmp    # Apply linear diffusion θ    matrix := dotProduct(matrix, C)    # Apply key addition σ[key]    matrix := matrix xor key    return matrixendfuncfunc whirlpool(M)    m, t := pad(M)  # Returns (paddedMessageDividedInChunks, amountOfChunks)    H := IM    for i from 0 to t        W := m[t]        Kr := H        W := W xor H        for r from 1 to R            cr := getConstantRoundMatrix(r)            Kr := whirlpoolRound(Kr, cr)            W := whirlpoolRound(W, Kr)        endfor        H := H xor W        H := H xor m[t]    endfor    return matrixToHexString(H)endfunc

For the linear-diffusion $\theta$ , amatrix multiplication is required.Galois Field arithmetic can be used to write thismultiplication algorithm:

func dotProduct(A, B)    tmp: Matrix    for i from 0 to 7        for j from 0 to 7            tmp[i * 8 + j] := 0            for k from 0 to 7                # Galois Field (2^8) multiplication                a := A[i * 8 + k];                b := B[k * 8 + j];                product := 0;                while b > 0                    if b & 1 == 1                        product := product xor a                    endif                    if a & 0x80 != 0                        a := (a << 1) xor 0x11d  # x^8 + x^4 + x^3 + x^2 + 1                    else                        a := a << 1                    endif                    b := b >> 1                endwhile                tmp[i * 8 + j] := tmp[i * 8 + j] xor product            endfor        endfor    endfor    return tmpendfunc

Here is an implementation of the 512-bit (64-bits size,big-endian)padding:

func pad(M)    original_length := len(M)  # In bytes    # 512 bits (total length) - 256 bits (size length) - 1 bit (padding bit)    #  64 bytes               -  32 bytes              - 1 byte = 31 bytes    padding := (31 - original_length) % 64    padding := (padding + 64) % 64  # Avoid negative padding    total_length := original_length + 1 + padding + 32  # In bytes    padded: Byte[total_length]    # Copy original message    for i from 0 to original_length - 1        padded[i] := M[i]    endfor    padded[original_length] := 0x80  # Append the '1' bit, then 7 '0' bits    for i from original_length + 1 to original_length + padding        padded[i] := 0x00  # Append 8 '0' bits    endfor    for i from 0 to 31        padded[total_length - 32 + i] := (original_length * 8) >> (8 * (31 - i)) & 0xff    endfor    chunk_amount := total_length / 64    divided := Byte[chunk_amount][64]    for i from 0 to chunk_amount - 1        for j from 0 to 63            divided[i][j] := padded[i * 64 + j]        endfor    endfor    return divided, chunk_amountendfunc

And here is an example of amatrix-to-string conversion:

func matrixToHexString(matrix)    HEX := "0123456789abcdef"    result: Byte[128]    for i from 0 to 63        byte := matrix[i]        result[i * 2] := HEX[byte >> 4]        result[i * 2 + 1] := HEX[byte & 0xf]    endfor    return resultendfunc

Adoption

[edit]

Two of the first widely used mainstream cryptographic programs that started using Whirlpool wereFreeOTFE, followed byTrueCrypt in 2005.^{[citation needed]}

VeraCrypt (a fork ofTrueCrypt) included Whirlpool (the final version) as one of its supported hash algorithms.^[6]

References

[edit]

^^a ^b ^c ^d ^e ^f ^g ^h ⁱ ^j ^k ^lFlorian Mendel1, Christian Rechberger, Martin Schläffer, Søren S. Thomsen (2009-02-24).The Rebound Attack: Cryptanalysis of Reduced Whirlpool and Grøstl(PDF). Fast Software Encryption: 16th International Workshop.{{cite conference}}: CS1 maint: multiple names: authors list (link) CS1 maint: numeric names: authors list (link)
^^a ^b ^c ^d ^ePaulo S. L. M. Barreto (2008-11-25)."The WHIRLPOOL Hash Function". Archived fromthe original on 2017-11-29. Retrieved2018-08-09.
^Barreto, Paulo S. L. M. & Rijmen, Vincent (2003-05-24)."The WHIRLPOOL Hashing Function". Archived fromthe original(ZIP) on 2017-10-26. Retrieved2018-08-09.{{cite journal}}:Cite journal requires|journal= (help)
^Kyoji, Shibutani & Shirai, Taizo (2003-03-11)."On the diffusion matrix employed in the Whirlpool hashing function"(PDF). Retrieved2018-08-09.{{cite journal}}:Cite journal requires|journal= (help)
^Li, W., Gao, Z., Gu, D., Ge, C., Liao, L., Zhou, Z., Liu, Y., & Liu, Z. (2017). Security Analysis of the Whirlpool Hash Function in the Cloud of Things. KSII Transactions on Internet and Information Systems, 11(1), 536–551.https://doi.org/10.3837/tiis.2017.01.028
^"Whirlpool".VeraCrypt Documentation. IDRIX. Retrieved2018-08-09.

External links

[edit]

The WHIRLPOOL Hash Function at theWayback Machine (archived 2017-11-29)
Jacksum onSourceForge, a Java implementation of all three revisions of Whirlpool
whirlpool onGitHub – An open sourceGo implementation of the latest revision of Whirlpool
A Matlab Implementation of the Whirlpool Hashing Function
RHash, anopen source command-line tool, which can calculate and verify Whirlpool hash.
Perl Whirlpool module atCPAN
Digest module implementing the Whirlpool hashing algorithm inRuby
Ironclad aCommon Lisp cryptography package containing a Whirlpool implementation
The ISO/IEC 10118-3:2004 standard
Test vectors for the Whirlpool hash from theNESSIE project
Managed C# implementation
Python Whirlpool module

v t e Cryptographic hash functions andmessage authentication codes
List Comparison Known attacks
Common functions	MD5 (compromised) SHA-1 (compromised) SHA-2 SHA-3 BLAKE2
SHA-3 finalists	BLAKE Grøstl JH Skein Keccak (winner)
Other functions	BLAKE3 CubeHash ECOH FSB Fugue GOST HAS-160 HAVAL Kupyna LSH Lane MASH-1 MASH-2 MD2 MD4 MD6 MDC-2 N-hash RIPEMD RadioGatún SIMD SM3 SWIFFT Shabal Snefru Streebog Tiger VSH Whirlpool
Password hashing/ key stretching functions	Argon2 Balloon bcrypt Catena crypt LM hash Lyra2 Makwa PBKDF2 scrypt yescrypt
General purpose key derivation functions	HKDF KDF1/KDF2
MAC functions	CBC-MAC DAA GMAC HMAC NMAC OMAC/CMAC PMAC Poly1305 SipHash UMAC VMAC
Authenticated encryption modes	CCM ChaCha20-Poly1305 CWC EAX GCM IAPM OCB
Attacks	Collision attack Preimage attack Birthday attack Brute-force attack Rainbow table Side-channel attack Length extension attack
Design	Avalanche effect Hash collision Merkle–Damgård construction Sponge function HAIFA construction
Standardization	CAESAR Competition CRYPTREC NESSIE NIST hash function competition Password Hashing Competition NSA Suite B CNSA
Utilization	Hash-based cryptography Merkle tree Message authentication Proof of work Salt Pepper

v t e Cryptography
General	History of cryptography Outline of cryptography Classical cipher Cryptographic protocol Authentication protocol Cryptographic primitive Cryptanalysis Cryptocurrency Cryptosystem Cryptographic nonce Cryptovirology Hash function Cryptographic hash function Key derivation function Secure Hash Algorithms Digital signature Kleptography Key (cryptography) Key exchange Key generator Key schedule Key stretching Keygen Machines Ransomware Random number generation Cryptographically secure pseudorandom number generator (CSPRNG) Pseudorandom noise (PRN) Secure channel Insecure channel Subliminal channel Encryption Decryption End-to-end encryption Harvest now, decrypt later Information-theoretic security Plaintext Codetext Ciphertext Shared secret Trapdoor function Trusted timestamping Key-based routing Onion routing Garlic routing Kademlia Mix network
Mathematics	Cryptographic hash function Block cipher Stream cipher Symmetric-key algorithm Authenticated encryption Public-key cryptography Quantum key distribution Quantum cryptography Post-quantum cryptography Message authentication code Random numbers Steganography
Category

v t e International Organization for Standardization (ISO) standards
List ofISO standards –ISO romanizations –IEC standards
1–9999	1 2 3 4 6 7 9 16 17 31 -0 -1 -3 -4 -5 -6 -7 -8 -9 -10 -11 -12 -13 68-1 128 216 217 226 228 233 259 261 262 302 306 361 500 518 519 639 -1 -2 -3 -5 -6 646 657 668 690 704 732 764 838 843 860 898 965 999 1000 1004 1007 1073-1 1073-2 1155 1413 1538 1629 1745 1989 2014 2015 2022 2033 2047 2108 2145 2146 2240 2281 2533 2709 2711 2720 2788 2848 2852 2921 3029 3103 3166 -1 -2 -3 3297 3307 3601 3602 3864 3901 3950 3977 4031 4157 4165 4217 4909 5218 5426 5427 5428 5725 5775 5776 5800 5807 5964 6166 6344 6346 6373 6385 6425 6429 6438 6523 6709 6943 7001 7002 7010 7027 7064 7098 7185 7200 7498 -1 7637 7736 7810 7811 7812 7813 7816 7942 8000 8093 8178 8217 8373 8501-1 8571 8583 8601 8613 8632 8651 8652 8691 8805/8806 8807 8820-5 8859 -1 -2 -3 -4 -5 -6 -7 -8 -8-I -9 -10 -11 -12 -13 -14 -15 -16 8879 9000/9001 9036 9075 9126 9141 9227 9241 9293 9314 9362 9407 9496 9506 9529 9564 9592/9593 9594 9660 9797-1 9897 9899 9945 9984 9985 9995
10000–19999	10006 10007 10116 10118-3 10160 10161 10165 10179 10206 10218 10279 10303 -11 -21 -22 -28 -238 10383 10585 10589 10628 10646 10664 10746 10861 10957 10962 10967 11073 11170 11172 11179 11404 11544 11783 11784 11785 11801 11889 11898 11940 (-2) 11941 11941 (TR) 11992 12006 12052 12182 12207 12234-2 12620 13211 -1 -2 13216 13250 13399 13406-2 13450 13485 13490 13567 13568 13584 13616 13816 13818 14000 14031 14224 14289 14396 14443 14496 -2 -3 -6 -10 -11 -12 -14 -17 -20 14617 14644 14649 14651 14698 14764 14882 14971 15022 15118 15189 15288 15291 15398 15408 15444 -3 -9 15445 15438 15504 15511 15686 15693 15706 -2 15707 15897 15919 15924 15926 15926 WIP 15930 15938 16023 16262 16355-1 16485 16612-2 16750 16949 (TS) 17024 17025 17100 17203 17369 17442 17506 17799 18004 18014 18181 18245 18629 18760 18916 19005 19011 19092 -1 -2 19114 19115 19125 19136 19407 19439 19500 19501 19502 19503 19505 19506 19507 19508 19509 19510 19600 19752 19757 19770 19775-1 19794-5 19831
20000–29999	20000 20022 20121 20400 20802 20830 21000 21001 21047 21122 21500 21778 21827 22000 22275 22300 22301 22395 22537 23000 23003 23008 23009 23090-3 23092 23094-1 23094-2 23270 23271 23360 23941 24517 24613 24617 24707 24728 25178 25964 26000 26262 26300 26324 27000 series 27000 27001 27002 27005 27006 27729 28000 29110 29148 29199-2 29500
30000+	30170 31000 32000 37001 38500 39075 40314 40500 42010 45001 50001 55000 56000 80000
Category