Content uploaded by Vincent Rijmen
Author content
All content in this area was uploaded by Vincent Rijmen
Content may be subject to copyright.
The WHIRLPOOL Hashing Function
Paulo S.L.M. Barreto1?and Vincent Rijmen2??
1Scopus Tecnologia S. A.
Av. Mutinga, 4105 - Pirituba
BR–05110–000 S˜ao Paulo (SP), Brazil
pbarreto@scopus.com.br
2Cryptomathic NV,
Lei 8A,
B–3000 Leuven, Belgium
vincent.rijmen@cryptomathic.com
Abstract. We present Whirlpool, a 512-bit hash function operating
on messages less than 2256 bits in length. The function structure is de-
signed according to the Wide Trail strategy and permits a wide variety
of implementation tradeoffs.
(Revised on May 24, 2003)
1 Introduction
In this document we describe Whirlpool, a one-way, collision resistant 512-bit
hashing function operating on messages less than 2256 bits in length.
Whirlpool consists of the iterated application of a compression function,
based on an underlying dedicated 512-bit block cipher that uses a 512-bit key.
The round function and the key schedule are designed according to the Wide
Trail strategy [2]. Whirlpool implementations on 8-bit and 64-bit processors
benefit especially from the function structure, which nevertheless is not oriented
toward any particular platform.
As originally submitted for the NESSIE project [17], Whirlpool employed
a randomly generated substitution box (S-box) whose lack of internal structure
tended to make efficient hardware implementation a challenging and tricky pro-
cess. The present document describes an S-box that is much more amenable
to hardware implementation, while not adversely affecting any of the software
implementation techniques suggested herein. No effective algebraic attack based
on the recursive structure of the new S-box has been reported.
?Co-sponsored by the Laborat´orio de Arquitetura e Redes de Computadores (LARC),
Departamento de Engenharia de Computa¸c˜ao e Sistemas Digitais, Escola Polit´ecnica
da Universidade de S˜ao Paulo, Brazil.
?? Co-sponsored by the Institute for Applied Information Processing and Communica-
tions (IAIK), Graz University of Technology, Inffeldgasse 16a, A–8010 Graz, Austria.
Recently, Shirai and Shibutani [22] discovered a flaw in the Whirlpool
diffusion matrix that made its branch number suboptimal. Although this flaw per
se does not seem to introduce an effective vulnerability, the present document
replaces that matrix by one that, besides displaying optimal branch number
and thus keeping our security analysis unchanged, also leads to more efficient
implementation in 8-bit platforms and hardware.
This document is organised as follows. The mathematical preliminaries and
notation employed are described in section 2. A mathematical description of the
Whirlpool primitive is given in section 3. A statement of the claimed security
properties and expected security level is made in section 4. An analysis of the
primitive with respect to standard cryptanalytic attacks is provided in section 5
(a statement that there are no hidden weaknesses inserted by the designers is
explicitly made in section 5.5). Section 6 contains the design rationale explaining
design choices. Implementation guidelines to avoid implementation weaknesses
are given in section 7. Estimates of the computational efficiency in software are
provided in section 8. The overall strengths and advantages of the primitive are
listed in section 9.
2 Mathematical preliminaries and notation
We now summarise the mathematical background and notation that will be used
throughout this paper.
2.1 Finite fields
We will represent the field GF(24) as GF(2)[x]/p4(x) where p4(x) = x4+x+ 1,
and the field GF(28) as GF(2)[x]/p8(x) where p8(x) = x8+x4+x3+x2+ 1.
Polynomials p4(x) and p8(x) are the first primitive polynomials of degrees 4 and
8 listed in [14], and were chosen so that g(x) = xis a generator of GF(24)\ {0}
and GF(28)\ {0}, respectively.
A polynomial u=Pm−1
i=0 ui·xi∈GF(2)[x], where ui∈GF(2) for all i=
0, . . . , m −1, will be denoted by the numerical value Pm−1
i=0 ui·2i, and written
in hexadecimal notation. For instance, we write 13xto denote p4(x).
2.2 Matrix classes
Mm×n[GF(28)] denotes the set of m×nmatrices over GF(28).
cir(a0, a1, . . . , am−1) stands for the m×mcirculant matrix whose first row
consists of elements a0, a1, . . . , am−1, i.e.
cir(a0, a1, . . . , am−1)≡
a0a1. . . am−1
am−1a0. . . am−2
.
.
..
.
.....
.
.
a1a2. . . a0
,
or simply cir(a0, a1, . . . , am−1) = c⇔cij =a(j−i) mod m,06i, j 6m−1.
2
2.3 MDS codes
The Hamming distance between two vectors uand vfrom the n-dimensional
vector space GF(2p)nis the number of coordinates where uand vdiffer.
The Hamming weight wh(a) of an element a∈GF(2p)nis the Hamming
distance between aand the null vector of GF(2p)n, i.e. the number of non-zero
components of a.
Alinear [n, k, d]code over GF(2p) is a k-dimensional subspace of the vec-
tor space (GF(2p))n, where the Hamming distance between any two distinct
subspace vectors is at least d(and dis the largest number with this property).
Agenerator matrix Gfor a linear [n, k, d] code Cis a k×nmatrix whose
rows form a basis for C. A generator matrix is in echelon or standard form if it
has the form G= [Ik×kAk×(n−k)], where Ik×kis the identity matrix of order k.
We write simply G= [I A] omitting the indices wherever the matrix dimensions
are irrelevant for the discussion, or clear from the context.
Linear [n, k, d] codes obey the Singleton bound:d6n−k+ 1. A code that
meets the bound, i.e. d=n−k+1, is called a maximal distance separable (MDS)
code. A linear [n, k, d] code Cwith generator matrix G= [Ik×kAk×(n−k)] is MDS
if, and only if, every square submatrix formed from rows and columns of Ais
non-singular (cf. [15, chapter 11, §4, theorem 8]).
2.4 Cryptographic properties
A product of mdistinct Boolean variables is called an m-th order product of
the variables. Every Boolean function f: GF(2)n→GF(2) can be written as a
sum over GF(2) of distinct m-order products of its arguments, 0 6m6n; this
is called the algebraic normal form of f.
The non-linear order of f, denoted ν(f), is the maximum order of the terms
appearing in its algebraic normal form. A linear Boolean function is a Boolean
function of non-linear order 1, i.e. its algebraic normal form only involves isolated
arguments. Given α∈GF(2)n, we denote by lα: GF(2)n→GF (2) the linear
Boolean function consisting of the sum of the argument bits selected by the bits
of α:
lα(x)≡
n−1
M
i=0
αi·xi.
A mapping S: GF(2n)→GF(2n), x 7→ S[x], is called a substitution box,
or S-box for short. An S-box can also be viewed as a mapping S: GF(2)n→
GF(2)nand therefore described in terms of its component Boolean functions
si: GF(2)n→GF(2),06i6n−1, i.e. S[x] = (s0(x), . . . , sn−1(x)).
The non-linear order of an S-box S, denoted νS, is the minimum non-linear
order over all linear combinations of the components of S:
νS≡min
α∈GF(2)n
{ν(lα◦S)}.
3
The δ-parameter of an S-box Sis defined as
δS≡2−n·max
a6=0, b #{c∈GF(2n)|S[c⊕a]⊕S[c] = b}.
The value 2n·δis called the differential uniformity of S.
The correlation c(f, g) between two Boolean functions fand gis defined as:
c(f, g)≡21−n·#{x|f(x) = g(x)} − 1.
The extreme value (i.e. either the minimum or the maximum, whichever is
larger in absolute value) of the correlation between linear functions of input bits
and linear functions of output bits of Sis called the bias of S.
The λ-parameter of an S-box Sis defined as the absolute value of the bias:
λS≡max
(i,j)6=(0,0) |c(li, lj◦S)|.
The branch number Bof a linear mapping θ: GF(2p)k→GF(2p)mis defined
as
B(θ)≡min
a6=0 {wh(a)+wh(θ(a))}.
Given a [k+m, k, d] linear code over GF(2p) with generator matrix G=
[Ik×kMk×m], the linear mapping θ: GF(2p)k→GF(2p)mdefined by θ(a) = a·M
has branch number B(θ) = d; if the code is MDS, such a mapping is called an
optimal diffusion mapping [20].
2.5 Miscellaneous notation
Given a sequence of functions fm, fm+1, . . . , fn−1, fn, m 6n, we use the notation
n
r=mfr≡fm◦fm+1 ◦ · · ·◦ fn−1◦fn, and r=n
mfr≡fn◦fn−1◦ · · ·◦ fm+1 ◦fm;
if m > n, both expressions stand for the identity mapping.
3 Description of the WHIRLPOOL primitive
The Whirlpool primitive is a Merkle hashing function (cf. [16, algorithm 9.25])
based on a dedicated block cipher, W, which operates on a 512-bit hash state
using a chained key state, both derived from the input data. In the following
we will individually define the component mappings and constants that build
up Whirlpool, then specify the complete hashing function in terms of these
components.
3.1 Input and output
The hash state is internally viewed as a matrix in M8×8[GF(28)]. Therefore, 512-
bit data blocks (externally represented as byte arrays by sequentially grouping
the bits in 8-bit chunks) must be mapped to and from this matrix format. This
is done by function µ: GF(28)64 → M8×8[GF(28)] and its inverse:
µ(a) = b⇔bij =a8i+j,06i, j 67.
4
3.2 The non-linear layer γ
Function γ:M8×8[GF(28)] → M8×8[GF(28)] consists of the parallel application
of a non-linear substitution box S: GF(28)→GF(28), x 7→ S[x] to all bytes of
the argument individually:
γ(a) = b⇔bij =S[aij ],06i, j 67.
The substitution box is discussed in detail in section 6.2.
3.3 The cyclical permutation π
The permutation π:M8×8[GF(28)] → M8×8[GF(28)] cyclically shifts each
column of its argument independently, so that column jis shifted downwards
by jpositions:
π(a) = b⇔bij =a(i−j) mod 8,j ,06i, j 67.
The purpose of πis to disperse the bytes of each row among all rows.
3.4 The linear diffusion layer θ
The diffusion layer θ:M8×8[GF(28)] → M8×8[GF(28)] is a linear mapping
based on the [16,8,9] MDS code with generator matrix GC= [I C] where C=
cir(01x,01x,04x,01x,08x,05x,02x,09x),i.e.
C=
01x01x04x01x08x05x02x09x
09x01x01x04x01x08x05x02x
02x09x01x01x04x01x08x05x
05x02x09x01x01x04x01x08x
08x05x02x09x01x01x04x01x
01x08x05x02x09x01x01x04x
04x01x08x05x02x09x01x01x
01x04x01x08x05x02x09x01x
,
so that θ(a) = b⇔b=a·C. The effect of θis to mix the bytes in each state
row.
3.5 The key addition σ[k]
The affine key addition σ[k] : M8×8[GF(28)] → M8×8[GF(28)] consists of the
bitwise addition (exor) of a key matrix k∈ M8×8[GF(28)]:
σ[k](a) = b⇔bij =aij ⊕kij ,06i, j 67.
This mapping is also used to introduce round constants in the key schedule.
5
3.6 The round constants cr
The round constant for the r-th round, r > 0, is a matrix cr∈ M8×8[GF(28)],
defined as:
cr
0j≡S[8(r−1) + j],06j67,
cr
ij ≡0,16i67,06j67.
3.7 The round function ρ[k]
The r-th round function is the composite mapping ρ[k] : M8×8[GF(28)] →
M8×8[GF(28)], parametrised by the key matrix k∈ M8×8[GF(28)] and given
by:
ρ[k]≡σ[k]◦θ◦π◦γ.
3.8 The key schedule
The key schedule expands the 512-bit cipher key K∈ M8×8[GF(28)] onto a
sequence of round keys K0, . . . , KR:
K0=K,
Kr=ρ[cr](Kr−1), r > 0,
3.9 The internal block cipher W
The dedicated 512-bit block cipher W[K] : M8×8[GF(28)] → M8×8[GF(28)],
parametrised by the 512-bit cipher key K, is defined as
W[K] = r=R
1
ρ[Kr]◦σ[K0],
where the round keys K0, . . . , KRare derived from Kby the key schedule. The
default number of rounds is R= 10.
3.10 Padding and MD-strengthening
Before being subjected to the hashing operation, a message Mof bit length
L < 2256 is padded with a 1-bit, then with as few 0-bits as necessary to obtain
a bit string whose length is an odd multiple of 256, and finally with the 256-bit
right-justified binary representation of L, resulting in the padded message m,
partitioned in tblocks m1, . . . , mt. These blocks are viewed as byte arrays by
sequentially grouping the bits in 8-bit chunks.
6
3.11 The compression function
Whirlpool iterates the Miyaguchi-Preneel hashing scheme [16, algorithm 9.43]
over the tpadded message blocks mi, 1 6i6t, using the dedicated 512-bit
block cipher W:
ηi=µ(mi),
H0=µ(IV ),
Hi=W[Hi−1](ηi)⊕Hi−1⊕ηi,16i6t,
where IV (the initialisation vector) is a string of 512 0-bits.
3.12 Message digest computation
The Whirlpool message digest for message message Mis defined as the output
Htof the compression function, mapped back to a bit string:
Whirlpool(M)≡µ−1(Ht).
4 Security goals
In this section, we present the goals we have set for the security of Whirlpool.
A cryptanalytic attack will be considered successful by the designers if it demon-
strates that a security goal described herein does not hold.
4.1 Expected strength
Assume we take as hash result the value of any n-bit substring of the full
Whirlpool output. Then:
–The expected workload of generating a collision is of the order of 2n/2exe-
cutions of Whirlpool.
–Given an n-bit value, the expected workload of finding a message that hashes
to that value is of the order of 2nexecutions of Whirlpool.
–Given a message and its n-bit hash result, the expected workload of finding a
second message that hashes to the same value is of the order of 2nexecutions
of Whirlpool.
Moreover, it is infeasible to detect systematic correlations between any linear
combination of input bits and any linear combination of bits of the hash result.
It is also infeasible to predict what bits of the hash result will change value when
certain input bits are flipped, i.e. Whirlpool is resistant against differential
attacks.
These claims result from the considerable safety margin taken with respect
to all known attacks. We do however realise that it is impossible to make non-
speculative statements on things unknown.
7
5 Analysis
In contrast to the extension of public research on block cipher cryptanalysis,
hashing function constructions based on block ciphers have received surprisingly
scarce attention. We summarise here the available research results applicable to
Whirlpool components.
5.1 Security of the compression function
The Miyaguchi-Preneel scheme is one of the few still unbroken methods to con-
struct a hashing function from an underlying block cipher [18]. Its security prop-
erties are discussed in [16, section 9.4.1]; in particular, it is “provably secure”
if certain ideal properties hold for the underlying block cipher. Recent research
results by Black, Rogaway and Shrimpton [1] further analyses the security prop-
erties of the Miyaguchi-Preneel and other schemes from a black-box perspective,
quantitatively corroborating the choice made for Whirlpool.
5.2 Differential cryptanalysis
The application of differential cryptanalysis techniques to hash functions based
on block ciphers has been studied in [19, 21]. Although there are some important
differences between differential attacks on block ciphers and differential attacks
on hash functions, basically the same techniques and reasonings apply. Both
attacks require that a differential characteristic is found, that has a sufficiently
large probability.
The branch number of the θtransform is B= 9. Due to the Square pattern
propagation theorem (cf. [20, proposition 7.9]), for any two different input values
of W, it holds that the number of S-boxes with a different input value in four
consecutive rounds is at least B2= 81. As a consequence, no differential charac-
teristic over four rounds of Whas probability larger than δB2= (2−5)81 = 2−405 .
This makes a classical differential attack very unlikely to succeed for the full hash
function.
5.3 Attacks against the internal block cipher W
For completeness, we list the best attacks known against the internal block cipher
Wwith reduced number of rounds. We point out, however, that these attacks
are not directly applicable to Whirlpool.
The best key recovery attack known against Wreduced to 7 rounds is an
extension of the attack by Gilbert and Minier [7]. The attack requirements are
264 guesses for one column of the first round key ×232 c-sets ×16 values to be
encrypted per entry ×2 tables ×2144 entries/table. This sums up to 2245 steps.
It is possible to mount an attack against 7 rounds of Wusing ideas described
in [6], but the complexity is extremely high: 2512 S-box lookups, 2128 bits of
storage and O(2512) plaintexts. This is essentially the complexity of finding a
8
preimage or second preimage by brute force (and certainly much larger than the
complexity of finding a collision by means of the birthday paradox).
No attack is known against more rounds of Wfaster than exhaustive search.
5.4 Encryption-decryption cascade:
Since Whirlpool does not use the decryption form of the internal cipher W,
encryption-decryption cascades as described in [16, pp. 39] would imply the
existence of semi-weak keys, such that encryption with one key corresponds to
decryption with another key. We don’t believe that semi-weak keys exist for
Whirlpool.
5.5 Designers’ statement on the absence of hidden weaknesses
In spite of any analysis, doubts might remain regarding the presence of trapdoors
deliberately introduced in the algorithm. That is why the NESSIE project asks
for the designers’ declaration on the contrary.
Therefore we, the designers of Whirlpool, do hereby declare that there are
no hidden weaknesses inserted by us in the Whirlpool primitive.
6 Design rationale
6.1 Hashing mode
Why Miyaguchi-Preneel instead of, say, Matyas-Meyer-Oseas (MMO)? Notice
that the key schedule resembles encryption of the cipher key under a pseudo-key
defined by the round constants, so that the core of the hashing process could
be formally viewed as two interacting encryption lines. Consider the encryption
W[Hi−1](ηi). We could write the last round key as KR=W0[c](Hi−1); this
quantity is exored onto the cipher state as the last encryption step. Now take
a look at the MMO recursion: Hi=W[Hi−1](ηi)⊕ηi. Formally applying this
construction to the “key encryption line” we get K0R=W0[c](Hi−1)⊕Hi−1.
Using this value as the effective last round key formally creates two interacting
MMO lines (as compared to the interacting encryption lines), and results in the
Miyaguchi-Preneel scheme, which therefore shows up as the natural choice for
the compression function.
6.2 Choice of the substitution box
The originally submitted form of Whirlpool used a pseudo-randomly gener-
ated S-box, chosen to satisfy the following conditions:
–The δ-parameter must not exceed 8 ×2−8.
–The λ-parameter must not exceed 16 ×2−6.
–The non-linear order νmust be maximum, namely, 7.
9
The bounds on δand λcorrespond to twice the minimum achievable values for
these quantities. An additional condition, that the S-box has no fixed point, was
imposed in an attempt to speed up the search. This condition was inspired by
the empirical study reported in [26, section 2.3], where the strong correlation
found between the cryptographic properties and the number of fixed points of a
substitution box suggests minimising the number of such points. The polynomial
and rational representations of Sover GF(28) are checked as well, to avoid any
obvious algebraic weakness (which could lead e.g. to interpolation attacks [10]).
However, the extreme lack of structure in such an S-box hinders efficient hard-
ware implementation. Moreover, a flaw that went unnoticed in the random search
program caused the value of λfor the original S-box to be incorrectly reported
as 15 ×2−6instead of the actual value 16 ×2−6(corresponding to a negative
bias)1. Therefore, we now describe an alternative S-box that, besides strictly
satisfying the design conditions, is amenable to much more efficient implemen-
tation in hardware, while not affecting the software implementation techniques
presented here in any reasonable way.
The new S-box is illustrated in figure 1. This structure has its origin in a sim-
ple three-layer construction consisting of two non-linear layers (each containing
two 4 ×4 S-boxes) separated by a symmetric linear transform M: GF(24)2→
GF(24)2. The most general form such a transform can assume is given by the
matrix
M=a+ 1 a
a a + 1 , a ∈GF(24),
which reduces to the structure in figure 1 by setting R(u)≡a·u(the actual Ris
pseudo-randomly generated as described below). Thus, writing Sas a mapping
S: GF(24)2→GF(24)2,S(u, v) = (u0, v0), we have
u0=E(E(u)⊕r), v0=E−1(E−1(v)⊕r),
where r≡R(E(u)⊕E−1(v)).
The Etable (as well as its inverse E−1) is not generated at random; rather, it
is derived from a simple exponential mapping with optimal δ,λ, and ν, namely:
E: GF(24)→GF(24) : E(u) = Bu
xif u6=Fx,
0xotherwise,
where the occurrence of u=u3x3+u2x2+u1x+u0as an exponent in Bu
xis
taken to be its numerical value P3
i=0 ui·2i. The basis Bxwas chosen so that E
has neither fixed points (i.e. values usuch that E(u) = u) nor points usuch that
E(E(u)) = u. Notice that E−1satisfies the same properties.
The Rtable is a pseudo-randomly generated permutation with optimal δ,λ,
and ν, chosen so that the S-box built from E,E−1and Rsatisfies the design
criteria listed at the beginning of this section.
Table 1 lists the Epermutation, and table 2 shows the Rpermutation found
by the searching algorithm.
1We thank the NESSIE evaluation team for pointing out this discrepancy [5].
10
EE−1
R
EE−1
???? ????
???? ????
iiii
iiii
iiii
-rr
-rr
-rr
-rr
?
?
?
?
????
?
?
?
?
????
????
-r-r-r-r
Fig. 1. Structure of the Whirlpool S-box. Ecorresponds to the mapping E:
GF(24)→GF(24) : E(u) = Bu
xif u6=Fx, and E(Fx) = 0. Ris pseudo-randomly
generated in a verifiable way. Both have optimal values of δ,λ, and ν.
The random search we carried out was able to find an S-box with λ= 14×2−6,
slightly better than the design bound. A description of the searching algorithm
and a listing of the resulting S-box are given in the appendix.
Table 1. The Emini-box
u0x1x2x3x4x5x6x7x8x9xAxBxCxDxExFx
E[u]1xBx9xCxDx6xFx3xEx8x7x4xAx2x5x0x
Table 2. The Rmini-box
u0x1x2x3x4x5x6x7x8x9xAxBxCxDxExFx
R[u]7xCxBxDxEx4x9xFx6x3x8xAx2x5x1x0x
6.3 Choice of the diffusion layer
The adopted circulant matrix Chas as many 1-elements as possible (namely,
3 per row) for an 8 ×8 circulant MDS matrix; furthermore, any element has
11
Hamming weight at most 2, and polynomial degree at most 3. These constraints
are especially advantageous for smart cards and dedicated hardware, and from
all matrices satisfying these criteria the actual selection leads to a particularly
efficient implementation on those platforms (see section 7.3).
6.4 The last round
One difference between the Whirlpool structure and the structure of
Square [3] and Rijndael [4] is the fact that, in the former, the operation
θis present in all rounds, while in the latter it is not present in the first or in the
last round. Firstly, we will explain why one application of the operation θcan
be left out without changing the security level of the cipher. Subsequently, we
list some motivations to leave out one application of the operation θ, followed
by the motivation why it was actually kept in for Whirlpool.
Why it is possible to leave θout: Consider a Square-like cipher with two
rounds, and an extra key addition:
E=σ[K2]◦τ◦γ◦θ◦σ[K1]◦τ◦γ◦θ◦σ[K0].(1)
As explained in [3], the operations θand σ[K] can be exchanged, provided that
the key Kis replaced by an equivalent key K0=θ(K). Consequently, we can
write (1) as:
E=σ[K2]◦τ◦γ◦θ◦σ[K1]◦τ◦γ◦σ[θ(K0)] ◦θ. (2)
In (2), it is obvious that the first application of θdoes not contribute to the
security of the cipher, because it can always be undone by an attacker, without
knowing the key. Therefore, we can leave it out of the definition of our cipher
(1). The new definition becomes:
E0=σ[K2]◦τ◦γ◦θ◦σ[K1]◦τ◦γ◦σ[K0].(3)
Observe that in this analysis we did not make any assumption about the
attack that an attacker is trying to mount. We proved generally that the security
of Eand E0are equivalent.
Motivation to leave θout: One motivation to leave out one application of
θ, is that it does not contribute to the cipher’s security. Furthermore, imple-
mentations on small processors that execute all transformations explicitly will
probably experience increased performance. Thirdly, (3) has the advantage that
encryption and decryption are more similar to one another2than for (1).
2However, in Whirlpool the internal cipher Woperates only in encryption mode,
hence the third motivation to keep θis not important here.
12
Motivation to leave θin: The best motivation to keep all rounds identical to
one another, is the performance on processors with a medium-sized fast cache
memory. If not all rounds are identical, then the number of tables that have to
be stored in memory increases. For fast implementations of Square, it turns
out that the tables for the complete rounds can be stored in the cache, but there
is no place left for the tables of the incomplete round. The net result is that the
round without θtakes longer to execute.
7 Implementation
Whirlpool can be implemented very efficiently. On different platforms, differ-
ent optimisations and tradeoffs are possible. We make here a few suggestions.
7.1 64-bit processors
We suggest a lookup-table approach to implement ρ. Let Ckbe the k-th row of
the circulant matrix C; using eight tables Tk[x]≡S[x]·Ck,06k67, i.e.:
T0[x] = S[x]·[01x01x04x01x08x05x02x09x],
T1[x] = S[x]·[09x01x01x04x01x08x05x02x],
T2[x] = S[x]·[02x09x01x01x04x01x08x05x],
T3[x] = S[x]·[05x02x09x01x01x04x01x08x],
T4[x] = S[x]·[08x05x02x09x01x01x04x01x],
T5[x] = S[x]·[01x08x05x02x09x01x01x04x],
T6[x] = S[x]·[04x01x08x05x02x09x01x01x],
T7[x] = S[x]·[01x04x01x08x05x02x09x01x],
then a row biof b= (θ◦π◦γ)(a) can be calculated with eight table lookups and
seven exor operations as:
bi=
7
M
k=0
Tk[a(i−k) mod 8,k ];
the key addition then completes the evaluation of ρwith a single additional
exor. The T-tables require 28×8 bytes of storage each. An implementation
can use the fact that the corresponding entries of different T-tables are cyclical
permutations of one another and save some memory at the expense of introducing
extra permutations at runtime. Usually this decreases the performance of the
implementation.
7.2 32-bit processors
Any circulant matrix Cof order 2mshows the following structure:
C=U V
V U ,
13
where Uand Vare matrices of order m. A 32-bit implementation may take
advantage of this structure by representing elements c∈GF(28)8as pairs c=
ˆc0ˆc1of elements ˆci∈GF(28)4:
b=θ(a)⇔ˆ
b0= ˆa0U⊕ˆa1V,
ˆ
b1= ˆa0V⊕ˆa1U,
with twice the complexity derived for 64-bit processors regarding the number of
table lookups and exors, but using smaller tables (each occupying 28×4 bytes).
7.3 8-bit processors
On an 8-bit processor with a limited amount of RAM, e.g. a typical smart
card processor, the previous approach is not feasible. On these processors the
substitution is performed byte by byte, combined with the σ[k] transformation.
For θ, it is necessary to implement the matrix multiplication. The following piece
of pseudo-code calculates one row of b=θ(a), using a table Xthat implements
multiplication by the polynomial g(x) = xin GF(28) (i.e. X[u]≡x·u) and five
auxiliary variables t0to t4, at the cost of 46 exors and 24 table lookups:
t0←ai1⊕ai3⊕ai5⊕ai7;
t1←ai3⊕ai6;
t2←ai5⊕ai0;
t3←ai7⊕ai2;
t4←ai1⊕ai4;
bi0←ai0⊕t0⊕X[ai2⊕X[t1⊕X[t4]]];
bi2←ai2⊕t0⊕X[ai4⊕X[t2⊕X[t1]]];
bi4←ai4⊕t0⊕X[ai6⊕X[t3⊕X[t2]]];
bi6←ai6⊕t0⊕X[ai0⊕X[t4⊕X[t3]]];
t0←ai0⊕ai2⊕ai4⊕ai6;
t1←ai4⊕ai7;
t2←ai6⊕ai1;
t3←ai0⊕ai3;
t4←ai2⊕ai5;
bi1←ai1⊕t0⊕X[ai3⊕X[t1⊕X[t4]]];
bi3←ai3⊕t0⊕X[ai5⊕X[t2⊕X[t1]]];
bi5←ai5⊕t0⊕X[ai7⊕X[t3⊕X[t2]]];
bi7←ai7⊕t0⊕X[ai1⊕X[t4⊕X[t3]]];
7.4 Techniques to avoid software implementation weaknesses
Hash functions do not use secret keys. In principle, they are not vulnerable to
the key recovery techniques described by Kocher et al. [12, 13]. However, hash
functions are sometimes used as building blocks for other cryptographic primi-
tives, such as MACs, that use secret keys. In that case, the necessary attention
14
should be given to the implementation of the round transformation as well as
the key scheduling of the primitive.
A first example is the timing attack [12] that can be applicable if the execu-
tion time of the primitive depends on the value of the key and the plaintext. This
is typically caused by the presence of conditional execution paths. For instance,
multiplication by a constant value over a finite field is sometimes implemented
as a multiplication followed by a reduction, the latter being implemented as a
conditional exor. This vulnerability is avoided by implementing the multiplica-
tion by a constant by means of table lookups, as proposed in sections 7.1, 7.2,
and 7.3.
A second class of attacks are the attacks based on the careful observation of
the power consumption pattern of an encryption device [13]. Protection against
this type of attack can only be achieved by combined measures at the hardware
and software level. We leave the final word on this issue to the specialists, but
we hope that the simple structure and the limited number of operations in
Whirlpool will make it easier to create an implementation that resists this
type of attacks.
7.5 Hardware implementation
We have currently no precise figures on the available performance and required
area or gate count of Whirlpool in ASIC or FPGA, nor do we have a de-
scription in VHDL. However, we expect that the results on Rijndael [9, 23] will
carry over to some extent3.
8 Efficiency estimates
Using the reference C implementation on a 1 GHz Pentium III platform, we
observe that Whirlpool operates at about 73 cycles per hashed byte. The
compression function runs at about 56 cycles per hashed byte.
Many factors explain the observed performance. First, a 32-bit processor was
used to test a native 64-bit implementation; better results are expected by merely
running the speed measurement on an Alpha or Itanium processor. Second, it
seems that the pipe parallelism capabilities of the Pentium were not fully used;
this may reflect a non-optimising implementation of 64-bit arithmetic support
by the C compiler, and might be overcome by an assembler implementation.
Third, the tables employed in the reference implementation are quite large, and
the built-in processor cache might not be enough to hold them, the data being
hashed, and the hashing code at once, thus degrading processing speed.
3In particular, the S-box structure can be implemented in about 1/5 the number of
gates used by the implementation of the Rijndael S-box reported in [24], which
takes about 500–600 gates [25].
15
9 Advantages
Whirlpool is much more scalable than most modern hashing functions. Even
though is not specifically oriented toward any platform, it is rather efficient on
many of them, its structure favouring extensively parallel execution of the com-
ponent mappings. At the same time, it does not require excessive storage space
(either for code or for tables), and can therefore be efficiently implemented in
quite constrained environments like smart cards, although it can benefit from
larger cache memory available on modern processors to achieve higher perfor-
mance. It does not use expensive or unusual instructions that must be built in
the processor. The mathematical simplicity of the primitive resulting from the
design strategy tends to make analysis easier. And finally, it has a very long hash
length; this not only provides increased protection against birthday attacks, but
also offers a larger internal state for entropy containment, as is needed for certain
classes of pseudo-random number generators [11].
10 Acknowledgements
We are grateful to Ra¨ıf Naffah, for carefully reading and suggesting improve-
ments for the implementation guidelines provided in this paper, and for imple-
menting several versions of Whirlpool in Java.
We are deeply indebted to Brian Gladman for providing software and hard-
ware facilities to search for efficient mini-box implementations in terms of
Boolean functions.
We thank Paris Kitsos for pointing out an error in the diagram displayed in
figure 1.
Finally, we would also like to thank the NESSIE project organisers and eval-
uation team for making this work possible.
References
1. J. Black, P. Rogaway, and T. Shrimpton, Black-box analysis of the block-
cipher-based hash-function constructions from PGV, Advances in Cryptology –
Crypto’2002, Lecture Notes in Computer Science, vol. 2442, Springer-Verlag, 2002,
pp. 320–335.
2. J. Daemen, Cipher and hash function design strategies based on linear and differ-
ential cryptanalysis, Ph.D. thesis, Katholieke Universiteit Leuven, March 1995.
3. J. Daemen, L.R. Knudsen, and V. Rijmen, The block cipher Square, Fast Software
Encryption – FSE’97, Lecture Notes in Computer Science, vol. 1267, Springer-
Verlag, 1997, pp. 149–165.
4. J. Daemen and V. Rijmen, The design of Rijndael, Springer-Verlag, Berlin, 2002,
Also described in NIST FIPS 197.
5. NESSIE evaluation team, private communication, 2001.
6. N. Ferguson, J. Kelsey, S. Lucks, B. Schneier, M. Stay, D. Wagner, and D. Whit-
ing, Improved cryptanalysis of Rijndael, Fast Software Encryption – FSE’2000,
Lecture Notes in Computer Science, vol. 1978, Springer-Verlag, 2000, pp. 213–230.
16
7. H. Gilbert and M. Minier, A collision attack on 7 rounds of Rijndael, Third
Advanced Encryption Standard Candidate Conference, NIST, 2000, pp. 230–241.
8. M. Hoskin, The cambridge illustrated history of astronomy, Cambridge University
Press, London, 1997.
9. T. Ichikawa, T. Kasuya, and M. Matsui, Hardware evaluation of the AES finalists,
Third Advanced Encryption Standard Candidate Conference, NIST, 2000, pp. 279–
285.
10. T. Jakobsen and L.R. Knudsen, The interpolation attack on block ciphers, Fast
Software Encryption – FSE’97, Lecture Notes in Computer Science, vol. 1267,
Springer-Verlag, 1997, pp. 28–40.
11. J. Kelsey, B. Schneier, D. Wagner, and C. Hall, Cryptanalytic attacks on pseudo-
random number generators, Fast Software Encryption – FSE’98, Lecture Notes in
Computer Science, vol. 1372, Springer-Verlag, 1998, pp. 168–188.
12. P. Kocher, Timing attacks on implementations of Diffie-Hellman, RSA, DSS, and
other systems, Advances in Cryptology – Crypto’96, Lecture Notes in Computer
Science, vol. 1109, Springer-Verlag, 1996, pp. 104–113.
13. P. Kocher, J. Jaffe, and B. Jun, Differential power analysis, Advances in Cryptology
– Crypto’99, Lecture Notes in Computer Science, vol. 1666, Springer-Verlag, 1999,
pp. 388–397.
14. R. Lidl and H. Niederreiter, Introduction to finite fields and their applications,
Cambridge University Press, London, 1986.
15. F.J. MacWilliams and N.J.A. Sloane, The theory of error-correcting codes, North-
Holland Mathematical Library, vol. 16, North-Holland, London, 1977.
16. A.J. Menezes, P.C. van Oorschot, and S.A. Vanstone, Handbook of applied cryp-
tography, CRC Press, 1997.
17. NESSIE, New European Schemes for Signatures, Integrity, and Encryption,
http://cryptonessie.org, 2000.
18. B. Preneel, Analysis and design of cryptographic hash functions, Ph.D. thesis,
Katholieke Universiteit Leuven, January 1993.
19. , Differential cryptanalysis of hash functions based on block ciphers, Com-
puter and Communications Security, ACM, 1993, pp. 183–188.
20. V. Rijmen, Cryptanalysis and design of iterated block ciphers, Ph.D. thesis,
Katholieke Universiteit Leuven, October 1997.
21. V. Rijmen and B. Preneel, Improved characteristics for differential cryptanalysis of
hash functions based on block ciphers, Fast Software Encryption – FSE’95, Lecture
Notes in Computer Science, vol. 1008, Springer-Verlag, 1995, pp. 242–248.
22. T. Shirai and K. Shibutani, On the diffusion matrix employed in the Whirlpool
hashing function, NESSIE public report, 2003.
23. B. Weeks, M. Bean, T. Rozylowicz, and C. Ficke, Hardware performance simula-
tions of round 2 AES algorithms, Third Advanced Encryption Standard Candidate
Conference, NIST, 2000, pp. 286–304.
24. D. Whiting, AES implementations in 0.25µm ASIC, NIST AES electronic discus-
sion forum posting, 2000.
25. , private communication, 2001.
26. A.M. Youssef, S.E. Tavares, and H.M. Heys, A new class of substitution-
permutation networks, Selected Areas in Cryptography – SAC’96, Workshop
record, 1996, pp. 132–147.
17
A Generation of the WHIRLPOOL S-box
The only part of the S-box structure left unspecified in figure 1 is the Rpermu-
tation, which is generated pseudo-randomly in a verifiable way.
The searching algorithm starts with a simple permutation without fixed
points (namely, the negation mapping u7→ ¯u=u⊕Fx), and derives from it
a sequence of 4 ×4 substitution boxes (“mini-boxes”) with the optimal values
δ= 1/4, λ= 1/2, and ν= 3. Each such mini-box is combined with Eand E−1
according to the diagram shown in figure 1; finally, the resulting 8 ×8 S-box, if
free of fixed points, is tested for the design criteria regarding δ,λ, and ν.
Given a mini-box at any point during the search, a new one is derived from
it by choosing a pair of distinct values that are not the image of one another and
swapping them, keeping the result free of fixed points; this is repeated until the
running mini-box has optimal values of δ,λ, and ν.
The pseudo-random number generator is implemented with Rijndael [4] in
counter mode, with a fixed key consisting of 256 zero bits and an initial counter
value consisting of 128 zero bits.
The following pseudo-code fragment illustrates the computation of the chain
of mini-boxes and the resulting S-box:
// initialize Rto the negation permutation:
for (u←0; u < 256; u++) {
R[u]←¯u;
}
// look for S-box conforming to the design criteria:
do {
// generate a random permutation free of fixed points:
do {
do {
// randomly select xand ysuch that
// x6=y,R[x]6=y, and R[y]6=x:
z←RandomByte(); x←z4; y←z&0Fx;
}while (x=y∨R[x] = y∨R[y] = x);
// swap entries:
u←R[x]; R[x]←R[y]; R[y]←u;
}while (δ(R)>1/4∨λ(R)>1/2∨ν(R)<3);
// build S-box from the mini-boxes (see figure 1):
for (u←0; u < 256; u++) {
x←E[u4]; y←E−1[u&0Fx];
r←R[x⊕y]; x←x⊕r;y←y⊕r;
S[u]←(E[x]4) |E−1[y];
}
// test design criteria:
}while (#FixedPoints(S)>0∨δ(S)>2−5∨λ(S)>2−2∨ν(S)<7);
18
B Hardware implementation
Restricting the allowed logical gates to AND, OR, NOT, and XOR, the Emini-
box and its inverse can be implemented with 18 logical gates each, while the R
mini-box needs 17 logical gates. Therefore, the complete S-box can be imple-
mented with 101 gates.
The pseudo-code fragments shown in figure 2 illustrate this (u=u3x3+
u2x2+u1x+u0∈GF(24) denotes the mini-box input, z=z3x3+z2x2+z1x+z0∈
GF(24) denotes its output, and the tkdenote intermediate values). We point out,
however, that the search for efficient Boolean expressions for the mini-boxes has
not been thorough, and it is likely that better expressions exist.
z=E[u]z=E−1[u]z=R[u]
t0←u0∧u2t0← ¬u0t0← ¬u0
t0←t0⊕u1t1←u0∨u1t1←u2∧u3
t2← ¬u0t1←t1⊕u3t2←u0⊕t1
t1←u3⊕t2t2←u2∧t1t2←t2∨u1
t2←t0∨t1z3←t0⊕t2t3←u3∨t0
z0←u0⊕t2t2←u0∧u2z2←t2⊕t3
t2←u2∧t0t3←u0∨u3t2← ¬u2
t1←t1⊕t2t3←t3⊕t2t2←t2⊕t3
t2←u3∨z0t3←t3∧u1t3←u1∨t2
z1←t2⊕t1z0←t0⊕t3z3←t1⊕t3
t2←u2⊕t1t2←t2⊕u1t3←t3⊕t0
t1←t1⊕u3t3←u2⊕t0t0←u0∨z3
t0←t0⊕t2t4←z3⊕t2t1← ¬u1
t1←t1∨t0t1←t1∧t4t1←t1⊕u3
z2←t2⊕t1t2←t2∨t1z0←t0⊕t1
t1←z1∧z2z2←t3⊕t1t3←t3∨z0
t1←t1∨z0t0←t0∨u3z1←t2⊕t3
z3←t0⊕t1z1←t0⊕t2
Fig. 2. Boolean expressions for E,E−1, and R
For completeness, table 3 lists the resulting 8 ×8Whirlpool S-box.
C The name
Whirlpool is named after the Whirlpool galaxy in Canes Venatici (M51, or
NGC 5194), the first one recognised to have spiral structure by William Parsons,
third Earl of Rosse, in April 1845 [8].
19
Table 3. The Whirlpool S-box
00x01x02x03x04x05x06x07x08x09x0Ax0Bx0cx0dx0Ex0Fx
00x18x23xc6xE8x87xB8x01x4Fx36xA6xd2xF5x79x6Fx91x52x
10x60xBcx9Bx8ExA3x0cx7Bx35x1dxE0xd7xc2x2Ex4BxFEx57x
20x15x77x37xE5x9FxF0x4AxdAx58xc9x29x0AxB1xA0x6Bx85x
30xBdx5dx10xF4xcBx3Ex05x67xE4x27x41x8BxA7x7dx95xd8x
40xFBxEEx7cx66xddx17x47x9ExcAx2dxBFx07xAdx5Ax83x33x
50x63x02xAAx71xc8x19x49xd9xF2xE3x5Bx88x9Ax26x32xB0x
60xE9x0Fxd5x80xBExcdx34x48xFFx7Ax90x5Fx20x68x1AxAEx
70xB4x54x93x22x64xF1x73x12x40x08xc3xEcxdBxA1x8dx3dx
80x97x00xcFx2Bx76x82xd6x1BxB5xAFx6Ax50x45xF3x30xEFx
90x3Fx55xA2xEAx65xBAx2Fxc0xdEx1cxFdx4dx92x75x06x8Ax
A0xB2xE6x0Ex1Fx62xd4xA8x96xF9xc5x25x59x84x72x39x4cx
B0x5Ex78x38x8cxd1xA5xE2x61xB3x21x9cx1Ex43xc7xFcx04x
c0x51x99x6dx0dxFAxdFx7Ex24x3BxABxcEx11x8Fx4ExB7xEBx
d0x3cx81x94xF7xB9x13x2cxd3xE7x6Exc4x03x56x44x7FxA9x
E0x2AxBBxc1x53xdcx0Bx9dx6cx31x74xF6x46xAcx89x14xE1x
F0x16x3Ax69x09x70xB6xd0xEdxccx42x98xA4x28x5cxF8x86x
20
