Whirlpool Cryptographic Hash Function
Cryptography & Network Security (CN&S) Study Guide
Whirlpool is a high-security cryptographic hash function designed by Vincent Rijmen
and Paulo Barreto. It is a modern alternative to the MD and SHA families, offering a
512-bit output.
1. Introduction and Origin
• Name: Named after the Whirlpool Galaxy (M51) in the constellation Canes
Venatici.
• Creators: Designed by Vincent Rijmen (co-creator of AES) and Paulo S. L. M.
Barreto in 2000.
• Standardization: Recommended by the NESSIE project and part of the ISO/IEC
10118-3 international standard.
• Design Philosophy: Based on a substantially modified version of the Advanced
Encryption Standard (AES).
2. Basic Parameters
• Hash Length: Produces a fixed-length hash value of 512 bits (64 bytes).
• Input Size: Accepts any message with a length less than 2^256 bits.
• Block Size: Operates on message blocks of 512 bits.
• Structure: Follows the Merkle-Damgård construction for iterative hashing.
3. The Whirlpool Cipher (W)
• Internal Block Cipher: Uses a dedicated block cipher named 'W' at its core.
• State Matrix: Uses an 8x8 matrix of bytes (unlike the 4x4 matrix in AES).
Page 1
• Algebraic Field: Operations are performed in the Galois Field GF(2^8).
• Compression Function: Uses the Miyaguchi-Preneel scheme to turn the block
cipher into a hash function.
4. The Round Function (10 Rounds)
Each round involves four primary transformations:
• SubBytes: A non-linear substitution step using an S-box to provide confusion.
• ShiftColumns: A permutation step where bytes in each column are circularly
shifted.
• MixRows: A linear diffusion step providing high dispersion.
• AddRoundKey: A bitwise XOR operation between the current state and the
round key.
5. Key Schedule
• Key Generation: Round keys are generated using the block cipher 'W' itself.
• Symmetry: Key schedule uses the same transformations (SubBytes, MixRows,
etc.) as the data path.
• Round Constants: Specific constants are added in each round to break
symmetry.
6. Security Strengths
• Collision Resistance: Designed to require 2^256 operations to find a collision.
• Pre-image Resistance: Extremely difficult to find the original message (2^512
operations).
• Immunity: The 8x8 structure makes it immune to many attacks targeting the
original 4x4 AES.
• Diffusion: MixRows ensures every bit of the hash depends on every bit of the
message.
Page 2
7. Comparison and Operation
• vs. SHA-512: Considered more mathematically "clean" and conservative.
• Efficiency: Highly efficient in hardware implementations.
• Padding: Message is padded with a '1' bit, followed by '0's, and the 256-bit
length representation.
• Digital Signatures: Primarily used for data integrity and authenticity
verification.
• Password Hashing: Excellent for securing passwords against brute-force due to
512-bit length.
• Output Finalization: The final hash is the result of the last compression function
iteration.
Feature Whirlpool Value
Output Hash Size 512 bits
Input Block Size 512 bits
Number of Rounds 10
Internal Structure 8x8 State Matrix
Compression Scheme Miyaguchi-Preneel
Page 3