ISO/IEC 10118-2:2000
(Main)Information technology — Security techniques — Hash-functions — Part 2: Hash-functions using an n-bit block cipher
Information technology — Security techniques — Hash-functions — Part 2: Hash-functions using an n-bit block cipher
Technologies de l'information — Techniques de sécurité — Fonctions de brouillage — Partie 2: Fonctions de brouillage utilisant un chiffrement par blocs de n bits
General Information
Relations
Standards Content (Sample)
INTERNATIONAL ISO/IEC
STANDARD 10118-2
Second edition
2000-12-15
Information technology — Security
techniques — Hash-functions —
Part 2:
Hash-functions using an n-bit block cipher
Technologies de l'information — Techniques de sécurité — Fonctions de
brouillage —
Partie 2: Fonctions de brouillage utilisant un chiffrement par blocs de n bits
Reference number
ISO/IEC 10118-2:2000(E)
©
ISO/IEC 2000
---------------------- Page: 1 ----------------------
ISO/IEC 10118-2:2000(E)
PDF disclaimer
This PDF file may contain embedded typefaces. In accordance with Adobe's licensing policy, this file may be printed or viewed but shall not
be edited unless the typefaces which are embedded are licensed to and installed on the computer performing the editing. In downloading this
file, parties accept therein the responsibility of not infringing Adobe's licensing policy. The ISO Central Secretariat accepts no liability in this
area.
Adobe is a trademark of Adobe Systems Incorporated.
Details of the software products used to create this PDF file can be found in the General Info relative to the file; the PDF-creation parameters
were optimized for printing. Every care has been taken to ensure that the file is suitable for use by ISO member bodies. In the unlikely event
that a problem relating to it is found, please inform the Central Secretariat at the address given below.
© ISO/IEC 2000
All rights reserved. Unless otherwise specified, no part of this publication may be reproduced or utilized in any form or by any means, electronic
or mechanical, including photocopying and microfilm, without permission in writing from either ISO at the address below or ISO's member body
in the country of the requester.
ISO copyright office
Case postale 56 � CH-1211 Geneva 20
Tel. + 41 22 749 01 11
Fax + 41 22 749 09 47
E-mail copyright@iso.ch
Web www.iso.ch
Printed in Switzerland
ii © ISO/IEC 2000 – All rights reserved
---------------------- Page: 2 ----------------------
ISO/IEC 10118-2:2000(E)
Contents Page
Foreword.iv
Introduction.v
1 Scope .1
2 Normative references .1
3 Terms and definitions .1
4 Symbols and abbreviated terms .1
5 Use of the general model .2
6 Hash-function one .2
6.1 Parameter selection.2
6.2 Padding method.2
6.3 Initializing value .2
6.4 Round-function .2
6.5 Output transformation.3
7 Hash-function two .3
7.1 Parameter selection.3
7.2 Padding method.3
7.3 Initializing value .3
7.4 Round-function .4
7.5 Output transformation.5
8 Hash-function three.5
8.1 General.5
8.2 Parameter selection.5
8.3 Padding method.5
8.4 Initializing value .6
8.5 Round-function .6
8.6 Output transformation.8
9 Hash-function four.8
9.1 General.8
9.2 Parameter selection.8
9.3 Padding method.8
9.4 Initializing value .8
9.5 Round-function .8
9.6 Output transformation.10
Annex A (informative) Use of DEA.11
Annex B (informative) Examples .14
Bibliography.19
© ISO/IEC 2000 – All rights reserved iii
---------------------- Page: 3 ----------------------
ISO/IEC 10118-2:2000(E)
Foreword
ISO (the International Organization for Standardization) and IEC (the International Electrotechnical Commission)
form the specialized system for worldwide standardization. National bodies that are members of ISO or IEC
participate in the development of International Standards through technical committees established by the
respective organization to deal with particular fields of technical activity. ISO and IEC technical committees
collaborate in fields of mutual interest. Other international organizations, governmental and non-governmental, in
liaison with ISO and IEC, also take part in the work.
International Standards are drafted in accordance with the rules given in the ISO/IEC Directives, Part 3.
In the field of information technology, ISO and IEC have established a joint technical committee, ISO/IEC JTC 1.
Draft International Standards adopted by the joint technical committee are circulated to national bodies for voting.
Publication as an International Standard requires approval by at least 75 % of the national bodies casting a vote.
International Standard ISO/IEC 10118-2 was prepared by Joint Technical Committee ISO/IEC JTC 1, Information
technology, Subcommittee SC 27, IT Security techniques.
This second edition cancels and replaces the first edition (ISO/IEC 10118-2:1994), which has been technically
revised to conform to the general model described in ISO/IEC 10118-1, and to add two additional hash-functions.
Note, however, that implementations which comply with ISO/IEC 10118-2:1994 will be compliant with this edition of
ISO/IEC 10118-2.
ISO/IEC 10118 consists of the following parts, under the general title Information technology — Security
techniques — Hash-functions:
— Part 1: General
— Part 2: Hash-functions using an n-bit block cipher
— Part 3: Dedicated hash-functions
— Part 4: Hash-functions using modular arithmetic
Annexes A and B of this part of ISO/IEC 10118 are for information only.
iv © ISO/IEC 2000 – All rights reserved
---------------------- Page: 4 ----------------------
ISO/IEC 10118-2:2000(E)
Introduction
The International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC)
draw attention to the fact that it is claimed that compliance with this part of ISO/IEC 10118 may involve the use of a
patent concerning the “Data Authentication Using Modification Detection Codes Based on a Public One Way
Encryption Function,” (U.S. Patent 4,908,861 issued 1990-03-13).
ISO and IEC take no position concerning the evidence, validity and scope of this patent right.
The holder of this patent right has assured ISO and IEC that he is willing to negotiate licences under reasonable
and non-discriminatory terms and conditions with applicants throughout the world. In this respect, the statement of
the holder of this patent right is registered with ISO and IEC. Information may be obtained from:
Director of Licensing
International Business Machnies Corporation
500 Columbus Avenue
Thornwood, NY 10594
U.S.A.
Attention is drawn to the possibility that some of the elements of this part of ISO/IEC 10118 may be the subject of
patent rights other than those identified above. ISO and IEC shall not be held responsible for identifying any or all
such patent rights.
© ISO/IEC 2000 – All rights reserved v
---------------------- Page: 5 ----------------------
INTERNATIONAL STANDARD ISO/IEC 10118-2:2000(E)
Information technology — Security techniques —
Hash-functions —
Part 2:
Hash-functions using an n-bit block cipher
1 Scope
This part of ISO/IEC 10118 specifies hash-functions which make use of an n-bit block cipher algorithm. They are
therefore suitable for an environment in which such an algorithm is already implemented.
Four hash-functions are specified. The first provides hash-codes of length smaller than or equal to n,where n is the
block-length of the algorithm used. The second provides hash-codes of length less than or equal to 2n;the third
provides hash-codes of length equal to 2n; and the fourth provides hash-codes of length 3n. All four of the hash-
functions specified in this part of ISO/IEC 10118 conform to the general model specified in ISO/IEC 10118-1.
2 Normative references
The following normative documents contain provisions which, through reference in this text, constitute provisions of
this part of ISO/IEC 10118. For dated references, subsequent amendments to, or revisions of, any of these
publications do not apply. However, parties to agreements based on this part of ISO/IEC 10118 are encouraged to
investigate the possibility of applying the most recent editions of the normative documents indicated below. For
undated references, the latest edition of the normative document referred to applies. Members of ISO and IEC
maintain registers of currently valid International Standards.
ISO/IEC 10116:1997, Information technology — Security techniques — Modes of operation for an n-bit block cipher.
ISO/IEC 10118-1:2000, Information technology — Security techniques — Hash-functions — Part 1: General.
3 Terms and definitions
For the purposes of this part of ISO/IEC 10118, the terms and definitions given in ISO/IEC 10118-1 and the
following apply.
3.1
n-bit block cipher
a block cipher with the property that plaintext blocks and ciphertext blocks are n bits in length (see ISO/IEC 10116)
4 Symbols and abbreviated terms
For the purposes of this part of ISO/IEC 10118, the symbols and abbreviations given in ISO/IEC 10118-1 and the
following apply:
en-bit block cipher algorithm (see ISO/IEC 10116)
K Key for the algorithm e (see ISO/IEC 10116)
© ISO/IEC 2000 – All rights reserved 1
---------------------- Page: 6 ----------------------
ISO/IEC 10118-2:2000(E)
e (P) Operation of encipherment using the algorithm e and the key K (see ISO/IEC 10116) on plaintext P
K
u or u� Transformation of one n-bit block into a key for the algorithm e
L
B When n is even, the string composed of the n/2 leftmost bits of the block B. When n is odd, the string
composed of the (n+1)/2 leftmost bits of the block B
R
B When n is even, the string composed of the n/2 rightmost bits of the block B. When n is odd, the string
composed of the (n-1)/2 rightmost bits of the block B
x x
B When B is a string of nm-bit blocks, B represents the x-th m-bit block of B
x-y x-y
B When B is a string of nm-bit blocks, B represents the x-th through the y-th m-bit blocks of B
5 Use of the general model
The hash-functions specified in the next four clauses provide hash-codes H of length L . The hash-function
H
conforms to the general model specified in ISO/IEC 10118-1. For each of the four hash-functions that follow, it is
therefore only necessary to specify:
� the parameters L , L ;
1 2
� the padding method;
� the initializing value IV;
� the round-function �;
� the output transformation T.
The use of a hash-function defined using the general model will also require the selection of the parameter L .
H
6 Hash-function one
6.1 Parameter selection
The parameters L and L and L for the hash-function specified in this clause shall satisfy L = L = n,and L is
1 2 H
1 2 H
less than or equal to n.
6.2 Padding method
The selection of the padding method for use with this hash-function is beyond the scope of this part of
ISO/IEC 10118. Examples of padding methods are presented in annex A of ISO/IEC 10118-1:2000.
6.3 Initializing value
The selection of the IV for use with this hash-function is beyond the scope of this part of ISO/IEC 10118. The value
of the IV shall be agreed upon and fixed by the users of the hash-function.
6.4 Round-function
The round-function � combines a padded data block D (of L = n-bits) with H , the previous output of the round-
i 1 i-1
function (of L = n bits), to yield H. As part of the round-function it is necessary to choose a function u,which
2 i
transforms an n-bit block into a key for use with the block cipher algorithm e. The selection of the function u for use
with this hash-function is outside the scope of this part of ISO/IEC 10118 (see annex A for guidance).
2 © ISO/IEC 2000 – All rights reserved
---------------------- Page: 7 ----------------------
ISO/IEC 10118-2:2000(E)
The round-function itself is defined as follows:
� (D , H )= e (D )� D
j j-1 K j j
j
where K = u (H ). The round-function is shown in Figure 1.
j j-1
D
j
H
j-1
u
e
K
j
H
j
Figure 1 — Round-function of hash-function one
6.5 Output transformation
The output transformation T is simply truncation, i.e., the hash-code H is derived by taking the leftmost L bits of
H
the final output block H .
q
7 Hash-function two
7.1 Parameter selection
The parameters L and L and L for the hash-function specified in this clause shall satisfy L = n, L =2n, and L is
1 2 H
1 2 H
less than or equal to 2n.
7.2 Padding method
The selection of the padding method for use with this hash-function is beyond the scope of this part of
ISO/IEC 10118. Examples of padding methods are presented in annex A of ISO/IEC 10118-1:2000.
7.3 Initializing value
The selection of the IV (of length 2n) for use with this hash-function is beyond the scope of this part of
ISO/IEC 10118. The value of the IV shall be agreed upon and fixed by the users of the hash-function. However, the
L R
IV shall be selected such that u(IV ) and u′(IV ) are different.
© ISO/IEC 2000 – All rights reserved 3
---------------------- Page: 8 ----------------------
ISO/IEC 10118-2:2000(E)
7.4 Round-function
The round-function � combines a padded data block D (of L = n bits) with H , the previous output of the round-
i 1 i-1
function (of L =2n bits), to yield H. As part of the round-function it is necessary to choose two transformations u
2 i
and u�.These transformations are used to transform an output block into two suitable L bit keys for the algorithm e.
K
The specification of u and u� is beyond the scope of this part of ISO/IEC 10118. However, it should be taken into
consideration that the selection of u and u� is important for the security of the hash-function (see annex A).
L R L R
Set H and H equal to IV and IV respectively. The output blocks are calculated iteratively in the following way,
0 0
for j=1 to q:
� (D , H )= H
j j
j-1
L L R R
K = u(H )and K = u� (H )
j j
j-1 j-1
B = e L(D )� D , and B� = e R(D )� D
j K j j j K j j
j j
L L R R L R
H = B || B� and H =B� || Bj
j j j j j
The round-function is shown in Figure 2.
H
D
j-1 j
L R
H H
j-1 j-1
L
R
K e e
j
K
j
u
u�
L
R
H
H
j-1
j-1
L R
L R
B B
j j
B� B�
j j
L R
L R
B B�
j j
B� B
j j
L R
H H
j j
H
j
Figure 2 — Round-function of hash-function two
4 © ISO/IEC 2000 – All rights reserved
---------------------- Page: 9 ----------------------
ISO/IEC 10118-2:2000(E)
7.5 Output transformation
L R
If L is even, the hash-code is the concatenation of the L /2 leftmost bits of H and the L /2 leftmost bits of H .If
H H q H q
L
L is odd, the hash-code is the concatenation of the (L +1)/2 leftmost bits of H and the (L -1)/2 leftmost bits of
H H q H
R
H .
q
8 Hash-function three
The hash-function specified in this clause provides hash-codes of length L , where L is equal to 2n for even
H H
values of n.
8.1 General
Some specific definitions that are required to specify hash-function three follow.
Transformation u:
Define r mappings u , u , …, u from the ciphertext space to the key space, such that,
1 2 r
For all i, j from the set {1,2,…,r}, j� i, u(C)� u (C) for all values of C.
i j
This can be achieved by fixing specific key bits: e.g., if r = 8 one can fix three key bits to the values 000, 001, .,
111. Additional conditions might be imposed upon the mappings u, for example, to avoid the problems related to
i
weak keys or complementation properties of the block cipher.
Function f:
i
Define the r functions f as follows:
i
f (X,Y)= e (Y)� Y,1� i� r.
ui(X)
i
Linear mapping �:
Define the linear mapping � that takes as input a 2n-bit string X = x ||x ||x ||x and maps it to a 2n-bit string Y =
0 1 2 3
y ||y ||y ||y as follows:
0 1 2 3
y := x � x
0 0 3
y := x � x � x
1 0 1 3
y := x � x
2 1 2
y := x � x
3 2 3
Here x and y are n/2 bit strings.
i j
8.2 Parameter selection
The parameters L and L and L for the hash-function specified in this clause shall satisfy L =4n, L =8n, and L
1 2 H
1 2 H
is equal to 2n.
8.3 Padding method
The padding method for use with this hash-function shall be that specified in clause A.3 of ISO/IEC 10118-1:2000,
such that r = n.
© ISO/IEC 2000 – All rights reserved 5
---------------------- Page: 10 ----------------------
ISO/IEC 10118-2:2000(E)
8.4 Initializing value
The selection of the IV (of length 8n) for use with this hash-function is beyond the scope of this part
...
Questions, Comments and Discussion
Ask us and Technical Secretary will try to provide an answer. You can facilitate discussion about the standard in here.