ISO/IEC 10118-3:1998

ISO/IEC
INTERNATIONAL
10118-3
STANDARD
First edition
1998-06-01
Information technology - Security
Hash-functions -
techniques -
Part 3:
Dedicated hash-functions
Technologies de Yinformation - Techniques de s&wit6 - Fonctions de
brouillage -
Partie 3: Fonctions de hachage dgdikes
Reference number
ISO/IEC 10118-3: 1998(E)
lSO/IEC 10118-3 : 1998 (E)
Foreword
IS0 (the International Organization for Standardization) and IEC (the International Electrotechnical Com-
National bodies that are members of
mission) form the specialized system for worldwide standardization.
IS0 or IEC participate in the development of International Standards through technical committees estab-
lished by the respective organization to deal with particular fields of technical activity. IS0 and IEC technical
committees collaborate in fields of mutual interest. Other international organizations, governmental and
non-governmental, in liaison with IS0 and IEC, also take part in the work.
In the field of information technology, IS0 and IEC have established a joint technical committee, ISO/IEC
JTCl. Draft International Standards adopted by the joint technical committee are circulated to national
bodies for voting. Publication as an International Standard requires approval by at least 75% of the national
bodies casting a vote.
International Standard ISO/IEC 10118-3 was prepared by Joint Technical Committee ISO/IEC JTC 1, Ill-
formation techn,ology, Sub-Committee SC27, IT S ’ecwrity techniques.
ISO/IEC 10118 consists of the following parts, under the general title Infow2ation technology --- S ’ecnrity
techniques - Hash-functions:
- Part 1: Geneml
- Part 2: Hash-functions using an n-bit block cipher algorithm
- Part 3: Dedicated hash-functions
- Part 4: Hash-functions using modular withmetic
Further parts may follow.
Annexes A, B, and C of this part of ISO/IEC 10118 are for information only.
0 ISO/IEC 1998
All rights reserved. Unless otherwise specified, no part of this publication may be reproduced or
utilized in any form or by any means, electronic or mechanical, including photocopying and micro-
film, without permission in writing from the publisher.
ISO/IEC Copyright Office l Case postale 56 l CH- 1211 Geneve 20 l Switzerland
Printed in Switzerland
ii
INTERNATIONAL STANDARD @ lSo/lEC ISO/IEC 10118-3 : 1998 (E)
Information technology - Hash-
Security techniques -
functions - Part 3: Dedicated hash-functions
1 Scope of the first input to the round-function.
This part of ISO/IEC 10118 specifies dedicated hash-
3.2 hash-function identifier: A byte identifying
functions, i.e. specially designed hash-functions. The a specific hash-function.
hash-functions in this part of ISO/IEC 10118 are
3.3 round-function: A function $(., .) that trans-
based on the iterative use of a round-function. Three
forms two binary strings of lengths L1 and I,2 to a
distinct round-functions are specified, giving rise to
binary string of length La. It is used iteratively as part
distinct dedicated hash-functions” The first and third
of a hash-function, where it combines a data string of
provide hash-codes of lengths up to 160 bits, and the
length L1 with the previous output of length Lz.
second provides hash-codes of lengths up to 128 bits.
3.4 word: A string of 32 bits.
2 Normative reference
4 Symbols and notation
The following standard contains provisions which,
This part of ISO/IEC 10118 makes use of the following
through reference in the text, constitute provisions of
symbols and notation defined in ISO/IEC 10118-l.
this part of ISO/IEC 10118. At the time of publica-
tion, the edition indicated was valid. All standards are
D A data string to be input to the hash-function.
subject to revision and parties to agreements based on
this part of ISO/IEC 10118 are encouraged to investi-
H Hash-code.
gate the possibility of applying the most recent edition
II’ lnitializing value.
of the standard indicated below. Members of IEC and
IS0 maintain registers of currently valid International
L_k= Length (in bits) of a bit-string X.
Standards.
ISO/IEC 10118-l: 1994, Ir~formntion technology - X @ 1’ Exclusive-or of bit-strings X and Y.
Security techniques - Hash-functions - Pnrt I:
For the purpose of this Part of ISO/IEC 10118, the
General.
following symbols and notation apply:
3 Definitions
a;, at Sequences of indices used in specifying a round-
For the purposes of this part of ISO/IEC 10118, the
function.
definitions given in ISO/IEC 10118-l and the follow-
ing definitions apply.
B; A byte.
3.1 block: A bit-string of length L1, i.e. the length
c ’;,ci Constant words used in the round-functions.
@ ISO/IEC
ISO/IEC 10118-3 : 1998 (E)
Di A block derived from the data-string after the := A symbol denoting the ‘set equal to’ opera-
padding process. tion used in procedural specifications of round-
functions, where it indicates that the word on
f;,g; Functions taking three words as input and pro-
the left side of the symbol shall be made equal
ducing a single word as output, used in specifying
to the value of the expression on the right side
round-functions.
of the symbol.
H; A string of Lz bits which is used in the hashing
operation to store an intermediate result.
5 Requirements
L1 The length (in bits) of the first of the two input
Users who wish to employ a hash-function from this
strings to the round-function 4.
part of ISO/IEC 10118 shall select:
I52 The length (in bits) of the second of the two input
l one of the dedicated hash-functions specified be-
strings to the round-function 4, of the output
low; and
string from the round-function @, and of IV.
l the length LH of the hash-code K
y The number of blocks in the data string after the
padding and splitting processes.
NOTE l- The first and second dedicated
Sn(> The operation of ‘circular left shift’ by 71 bit
hash-functions are defined so as to facil-
i.e. if /I is a word and rt is a non-
positions,
itate software implementations for ‘little-
negative integer then S ”(A) denotes the word
endian computers, i.e. where the lowest-
obtained by left-shifting the contents of ~4 by n
addressed byte in a word is interpreted as the
places in a cyclic fashion.
least significant; conversely, the third round-
function is defined so as to facilitate soft-
ti, t: Shift-values used in specifying a round-function.
ware implementations for ‘big-endian’ com-
puters, i.e. where the lowest-addressed byte
IV, ‘JLri, S[, yi, Zi Words used to store the results of
in a word is interpreted as the most signif-
intermediate computations.
icant. However, by adjusting the definition
# A round-function, i.e. if X,Y are bit-strings of appropriately, any of the round-functions
lengths L1 and Lz respectively, then $(X7 Y)
can be implemented on a ‘big-endian’ or
is the string obtained by applying 4 to X and Y. a ‘little-endian’ computer. All the hash-
functions defined in this part of ISO/IEC
A The bit-wise logical AND operation on bit-strings,
10118 take a bit-string as input and give
i.e. if A, B are words then /I A B is the word
a bit-string as output; this is independent of
equal to the bit-wise logical AND of ,:I and B.
the internal byte-ordering convention used
within each hash-function.
v The bit-wise logical OR operation on bit-strings,
i.e. if /-I, B are words then /I V B is the word
NOTE 2 - The choice of LH affects the se-
equal to the bit-wise logical OR of i4 and B.
curity of the hash-function. All of the hash-
1 The bit-wise logical NOT operation on a bitAxing,
functions specified in this part of ISO/IEC
i.e. if /I is a word then 4 is the word equal to 10118 are believed to be collision-resistant
the bit-wise logical NOT of ,;1.
hash-functions in environments where per-
forming 2L~jl” hash-code computations is
~tl The modulo P addition operation, i.e. if /I, B are
deemed to be computationally infeasible.
words then LIMB is the word obtained by treating
A and B as the binary representations of integers
and computing their sum modulo P, where the
result is constrained to lie between 0 and Z3’ - 1
inclusive.
@ ISO/IEC ISO/IEC 10118-3 : 1998 (E)
6 Model for dedicated hash-functions the first L1 bits of the padded version of D, Dz rep-
resents the next L1 bits, and so on. The Padding and
6.1 General
Figure 1.
Splitting Processes are illustrated in
The hash-functions specified in this standard require
the use of a round-function 4. In subsequent clauses
of this part of ISO/IEC 10118, three alternatives for
padding added
the function 4 are specified.
The hash-functions which are specified in this stan-
dard provide hash-codes of length LH, where LH is
less than or equal to the value of L2 for the round- /I Padding
function 4 being used.
I I
I
I
In the specifications of the hash-functions in this part
of ISO/IEC 10118, it is assumed that the padded data-
&I ---- “-i-I Splitting
string input to the hash-function is in the form of a
sequence of bytes. If the padded data-string is in
the form of a sequence of &z bits, x0, x1,. . . , x8,-1) LL,J
I
I I
then it shall be interpreted as a sequence of n bytes,
in the following way. Each group
Bo7 Bl, l l l ? h-1 9
Figure 1: Padding & splitting processes
of eight consecutive bits is considered as a byte, the
first bit of a group being the most significant bit of
that byte. Hence
6.2.3 Step 3 (iteration)
D, be the Ll-bit blocks of the data
Let Dl,Dz,. ,
B = Z7X8i + Z6Xgi+1 + o l l + X82+7
i
after padding and splitting. Let Ho be a bit-string
for every i (0 5 i < n). equal to IV. The L,-bit strings HI, Hz,. . . , Hq are
calculated iteratively in the following way.
Identifiers are defined for each of the three dedicated
hash-functions specified in this standard. The hash-
function identifiers for the dedicated hash-functions
for i from 1 to Q:
specified in clauses 7, 8 and 9 are equal to 31, 32, and
33 (hexadecimal) respectively. The range of values
from 34 to 3F (h exadecimal) are reserved for future
use as hash-function identifiers by this part of ISO/IEC
10118.
6.2 Hashing operation
The Iteration Process is illustrated in Figure 2.
Let 6 be a round-function and IV be an initializing
value of length L2. For the hash-functions specified
in this part of ISO/IEC 10118, the value of the IV
D crt,I
i
shall be fixed for a given round-function 4.
The hash-code H of the data D shall be calculated
t *
t
in four steps.
6.2.1 Step 1 (padding)
Round-function 4
The data string D is padded in order to ensure that
its length is a multiple of L1. Specific instances of
padding methods are specified in subsequent clauses
t
of this part of ISO/IEC 10118.
6.2.2 Step 2 (splitting)
The padded version of the data string D is split into
Figure 2: The Iteration Process
&-bit blocks D1, D2, . . . , D,, where D1 represents
@ ISO/IEC
ISO/IEC 10118-3 : 1998 (E)
used in this round-function, where each function g;,
6.2.4 Step 4 (truncation)
0 < i < 79, takes three words -;kro, Xl and X.2 as
- -
The hash-code H is derived by taking the leftmost
input and produces a single word as output.
LH bits of the final &-bit output string N,.
The functions gi are defined as follows:
7 Dedicated Hash-Function 1
= x(-j @ x1 @ A& (0 5 2' 2 l!q,
g&q), 11-1, S,)
NOTE - This clause contains a description
gi(sO, X1, LYz) = (S" A x1 ) v (1X() A S,))
of the round-function, initializing value and
(16 < i < 31),
padding method for RIPEMD-160, [3].
tJi(-Y(j, /Yl, S,) = (X0 v--d<) @ X2, (:32 < 2' < 47)
(A-Q A A'?) v (S1 A -s,,. -
g&&-j, x1, X?) =
7.1 General
(48 < i < 6l3),
- -
In this clause we specify a padding method, an initial-
y;(S*, AjJ s,) = So c-j3 (X1 v +L), (64 < i < 79)
- -
izing value, and a round-function for use in the general
model described in this part of ISO/IEC 10118. The
padding method, initializing value and round-function
specified here, when used in the above general model,
7.2.4 Constants
together define Dedicated Hash-Function 1. This ded-
Two sequences of constant words &, cl,. . . , cl79 and
icated hash-function can be applied to all data strings
are used in this round-function. In a
c&c;,. ,c;cJ
D containing at most Z6’ - 1 bits.
hexadecimal representation (where the most signifi-
The ISO/IEC hash-f unction identifier for Dedicated
cant bit corresponds to the left-most bit) these are
Hash-Function 1 is equal to 31 (hexadecimal).
defined as follows:
7.2 Parameters, functions and constants
7.2.1 Parameters
-I
For this hash-function L1 = f512 and La = 160. = 00000000, (0 < i < 15),
c
i
f
c = 5A827999, (lb:< i< 31),
7.2.2 Byte ordering convention
’ i
c = GEDSEBAI, (32 7 i 147),
-1 i
In the specification of the round-function of clause 7 it
-1
is assumed that the block input to the round-function
(48 1 i 163),
c = 8FlBBCDC:
ji
is in the form of a sequence of words, each 512-bit
-1
= A953FD4E, (64 < i T 79)?
c- -1 i
-
block being made up of 16 such words. A sequence
of 64 bytes, Bo, Bl,. . . , B63, shall be interpreted as
a sequence of 16 words, Zo,Z17. . , Z,,, in the fol-
I/
c = 50A28BE6, (0 < i < L5),
Ji
lowing way. Each group of four consecutive bytes is
i/
c = 5C4DD124; pi--< i< 31),
considered as a word, the first byte of a word being Ji
I/
the least significant byte of that word. Hence
c = 6D703EF3, (32 T i 14T),
i
‘I/
c = 7A6D76E9, (4s 1 i T KS),
i
= 2"4B4i+3+21cjBqi+~+28Bq;tl+B,i, (0 < i < 15).
zi - -
/
c = 00000000, (64 1 i 7 79).
- -
i
To convert the hash-code from a sequence of words to
a byte-sequence, the inverse process shall be followed.
Two sequences of 80 shift-values are used in this
NOTE - The byte-ordering specified here
round-function, where each shift-value is between 5
is different from that of subclause 9.2.2.
and 15. We denote these sequences by (to, tl, . . . 7 tT9)
and (tb, ti?. . . , t&J. A further two sequences of 80 in-
7.2.3 Functions
dices are used in this round-function, where each value
To facilitate software implementation, the round- in the sequence is between 0 and 15. We denote these
function 4 is described in terms of operations on
sequences as (no? nl,. . . ? n;g>, and (nb, ~ ‘1,. . . , L&J.
words. A sequence of functions go, gl, . . . , gT9 is All four sequences are defined in the following table.
C ISO/IEC
ISO/IEC 10118-3 : 1998 (E)
i 0 1 2 3 4 5 6 7 i 72 73 74
75 76 77 78 79
k 11 14 15 12 5 8 7 9 ti
5 12 13 14 11 8 5 6
t; 8
9 9 11 13 15 15 5 ta
8 13 6 5 15 13 11 11
1 ai II 0 I 1 ai 14
I 2 I 3 I 4 I 5 I 6 I 7 I 1 3 8 11 6 15 13
a{ 5 14 7 0 9
2 11 4 ai 6
2 13 14 0 3 9 11
”
I 1 I
i 8 9 10 11
12 13 14 15
ti 11 13 7.2.5 Initialking Value
14 15 6 7 9 8
t; 7 7 8 11
14 14 12 6
For this round-function the initializing value, IV, shall
ai 8 9 10 11
12 13 14 15
always be the following 160-bit string, represented
a{ 13 6 15
8 1 10 3 12
here as a sequence of five words Yo, E;, Yz, Y3, Yd in a
i
16 17 18 19 20 21 hexadecimal representation, where Yo represents the
22 23
ti left-most 32 of the 160 bits:
7 6 8 13 11
9 7 15
t;
9 13 15 7 12
8 9 11
-
= 67452301,
xl
a; 7
4 13 1 10 6
15 3
I
k = EFCDAB89,
ai 6 11
3 7 0 13 5 1
i 24 = 98BADCFE,
25 26 27 1 28 K!
29 30 31
Y3 = 10325476,
Y = C3D2ElFO.
Y
I I 1 7.3 Padding method
I
i 32 33 34 35 36 37 38 39
The data string D needs to be padded to make it
t, 11 13 6 7 14 9 13 1.5
- -- -w
contain a number of bits which is an integer multiple
t: 9 7 15 11
8 6 6 14
of 512. The padding procedure operates as follows:
ai 3
10 14 4 9 15
8 1
Uf: 15 5 1
3 7 14 6
D is concatenated with a single ‘1’ bit.
i 40
41 42 43 44
45 46 47
The result of the previous step is concatenated
k 14 8 13 6 5 12
7 5
with between zero and 511 ‘0’ bits such that the
t; 12 13 5 14 13
13 7 5
length (in bits) of the resultant string is congru-
CL; 2 7 0 6 13 11
5 12
ent to 448 modulo 512. More explicitly, if the
u: 11 8 12 2
10 0 4 13
original length of D is LD, and letting T be the
i 48 49 1 50 51
52 53 54 55
remainder when LD is divided by 512, then the
ti 11 12 14 15
14 15 9 8
number of concatenated zeros is equal to either
t; 15 5 8 11 14
14 6 14
447 - 7’ (if 1‘ < 447)
or 959-r (if r > 447). The
-
a; 1 9 11
10 0 8 12 4
result will be a bit string whose length will be 64
ai 8 6 4
1 3 11 15 0
bits short of an integer multiple of 512 bits.
i 56 57
58 59 60 61 62 63
Divide the 64-bit binary representation of
LD
ti 9 14 5 6 8 6 5 12
into two 32-bit strings, one representing
the
t: 6 9 12 9 12 5 15 8
L
‘most significant half’ of LD and the other
the
ai
13 3 7 15 14 5 6 i
‘least significant half ’. Now concatenate the
ai 5 12 2 13 9 7 10 14
string resulting from the previous step with these
i 64 65 66 67 68 69 70 71
two 32-bit strings, with the ‘least significant half’
t, 9 15 5 11 6 8 13 12
preceding the ‘most significant half ’.
t; 8 5 12 9 12 5 14 6
I a; 4 0 5 9 7 12 2 10
In the description of the round-function which follows,
ai 12 15 10 4 1 5 8 7
each 512-bit data block D;, 1 < i 5 q, is treated as
a sequence of 16 words, Zo,Z~,. . . ,215, where 20
corresponds to the left-most 32 bits of Di.

@ ISO/IEC
ISO/IEC 10118-3 : 1998 (E)
the 20th (right-most) byte will corespond to the
7.4 Description of the round-function
most significant byte of 1,;. The 20 bytes shall
Note
The round-function 4 operates as follows.
be converted to a string of 160 bits using the in-
in this description, we use the symbols
that,
verse of the procedure specified in 6.1, i.e. the
W, X0 , X1 , -;k ’;! , X3 , X4 , AT-6 , Xi , Xi , Xi , XL; to de-
first (left-most) bit will correspond to the most
note eleven distinct words which contain values re-
significant bit of the first (left-most) byte, and
quired in the computations.
the 160th (right-most) bit will correspond to the
least significant bit of the 20th (right-most) byte.
1. Suppose the 512-bit (first) input to Q is con-
tained in ZO, Z1,. . . ? 215, where Zo contains the
left-most 32 of the 512 bits. Suppose also that
8 Dedicated Hash-Function 2
the 160-bit (second) input to 4 is contained in
five words, V& Yl! El ’& &, E;.
NOTE - This clause contains a description
of the round-function, initializing value and
2. Let X0 := Yb, X1 := E;, & := Yi, X3 := 1,;
padding method for RIPEMD-128, [3].
and X4 := Es>.
This hash-function should only be used in
3. Let X-5, := YO, _71 ’1 := &, -Xi := I,;, _;k ’i := &
applications where a hash-code containing
and Xi := 1;.
128 bits or less is considered adequately se-
cure.
4. For i := 0 to ‘79 do the following four steps in
the order specified:
8.1 General
(a) IV := St2(X&J@Y1, X2, X+JZQ21slCr;)W
In this clause we specify a padding method, an initial-
& ;
izing value, and a round-function for use in the general
(b) X0 := &; & := X3; X3 := S1 ’(X2);
model described in this part of ISO/IEC 10118. The
x-2 := x-1; x1 := w;
padding method, initializing value and round-function
(C) W I= St ’(2XA kJ tJTCJ_i(?Ci, -Yi: -Yh) Itl Z,t Itl
specified here, when used in the above general model,
c;l> kJ xi; together define Dedicated Hash-Function 2. This ded-
icated hash-function can be applied to all data strings
(d) sg, := X-i; Xi := X-4; 1X-h := S ’“(X-;);
D containing at most 2”” - 11 bits.
:I= q; Jy-; :I= Til/ ‘;
,Y ’ ;
The ISO/IEC hash-function identifier for Dedicated
5. Let
Hash-Function 2 is equal to 32 (hexadecimal).
.-
8.2 Parameters, functions and constants
w .-
&,
:= Yl km-~ km-;, 8.2.1 Parameters
Xl
Yl := Y&o+LY~,
For this hash-function L1 = !A ’2 and & = 1 ’128
:= kjax&;,l
JT2
8.2.2 Byte ordering convention
:= L;Kx-()Kx-;,
Y3
The byte ordering convention for this hash-function is
:= WUAY~ LOT;.
I:,
the same as that for the hash-function of clause 7.
8.2.3 Functions
6. The five words Yb, Y&Y& Y&Y> represent the
To facilitate software implementation, the round-
output of the round-function 4. After the fi-
function 4 is described in terms of operations on
nal iteration of the round-function, the five words
words. A sequence of functions go, gl,. . . , ,cjG3 is
Yo, Y1, Y&E& Yq shall be converted to a sequence
used in this round-function, where each function ,(I;,
of 20 bytes using the inverse of the procedure
0 < i < 63, takes three words X0, Xl and X2 as
- -
specified in 7.2.2, and where Yo shall yield the
input and produces a single word as output.
first four bytes, Y-1 the next four bytes, and so
on. Thus the first (left-most) byte will corre-
The functions 9; are defined to be the same as the
spond to the least significant byte of Eib, and first 64 of the functions defined in subclause 7.2.3.
@ ISO/IEC ISO/IEC 10118-3 : 1998 (E)
8.2.4 Constants The round-function 4 operates as follows.
Note
that, in this description, we use the symbols
Two sequences of constant words C ’o, Cl). . . , (763 and
IV, X0, X1, Xa, Xx, X& Xi, Xi, Xi to denote nine
. are used in this round-function. In a
c;,c;?. ,c&
distinct words which contain values required in the
hexadecimal representation (where the most signifi-
computations.
cant bit corresponds to the left-most bit) these are
defined as follows:
1,
Suppose the 512-bit (first) input to C#I is con-
, -
tained in Zo, Z1, . . . , Z15, where Zo contains the
c = 00000000, (0 < i < 1.5),
z - -
left-most 32 of the 512 bits. Suppose also that
c = 5A827999, (16 < i < 31),
i -
-
the 128-bit (second) input to 4 is contained in
c = GEDSEBAl, (32 < i < 47):
/i - -
four words, Yo: Yl, Yz, Y3.
c = 8FlBBCDC, (4s < i < 63),
/i - -
Let X0 := Yo, Xl := Yl, X2 := Y2 and X3 :=
YJ.
I/
c = 50A28BE6, (0 < i < 15),
i - -
It
Let X6 := Yo, Xi := Y;, Xi := Yz and Xi :=
c = 5C4DD124, (16 < i < 31):
-
i -
/
E I> .
c /. = 6D703EF3, (3'2 < i < 4i),
i - -
f/
c = 00000000, (48 < i < 63).
For i := 0 to 63 do the following four steps in
i - -
the order specified:
Two sequences of 64 shift-values are also used in this
round-function, where each shift-value is between 5 (a) W := Sti(XO~SI;(X1,X;?,~~3)~Z,;~Ci);
and 15. We denote these sequences by (to, tI, . , t )
l 7 63
(b) X0 := x-3; x-3 := x,; x2 := x-1; x1 :=
and (tb, ti, . . . , t&,), and they are defined to be equal .
w
?
to the first 64 values of the corresponding sequences
(c) w := St’ ( lXrh Itl CJ63-i( JC{ ),71 ’1, Xi) ItJ Z,! Itl
defined in subclause 7.2.4.
'1 .
c.>
Finally, two further sequences of 64 indices are used in
-/
:= *y;; x; := x;; x; := ,k ’;; x; :=
(d) . ‘rl
this round-function, where each value in the sequence
/ 7.
If
?
is between 0 and 15. We denote these sequences by
a63), and (n& a;,. . . ? c&), and they are
ao!%*-- I
( . e
5 Lt
defined to be equal to the first 64 values of the cor-
.-
.-
responding sequences defined in subclause 7.2.4. w
kb,
I$ := 1/; Itl x2 kJ x;,
8.2.5 Initialking Value
Yl := Y2 Itl x3 kJ x;,
For this hash-function the initializing value, IV, shall
always be the following 128-bit string, represented := Y ’,ux,kJx;,
K2
here as a sequence of four words Yb, Ifi7 Y& Y> in a
YJ := w kJx, km;.
hexadecimal representation, where Y. represents the
left-most 32 of the 128 bits:
6 . The four words I$, E;! Y2, Y3 represent the out-
put of the round-function #. After the final
El; = 67452301,
iteration of the round-function, the four words
1 = EFCDAB89;
'i
Yb, Ei, Y& Y3 shall be converted to a sequence
Y2
= 98BADCFE, of 16 bytes using the inverse of the procedure
specified in 7.2.2, and where Y. shall yield the
FJ = 10325476.
first four bytes, Yl the next four bytes, and so
on. Thus the first (left-most) byte will corre-
8.3 Padding method
spond to the least significant byte of Yo, and
The padding method to be used with this hash-
the 16th (right-most) byte will corespond to the
function shall be the same as the padding method
most significant byte of Y3. The 16 bytes shall
defined in subclause 7.3.
be converted to a string of 128 bits using the in-
8.4 Description of the round-function verse of the procedure specified in 6.1, i.e. the

@ ISO/IEC
ISO/IEC 10118-3 : 1998 (E)
first (left-most) bit will correspond to the most 9.2.3 Functions
significant bit of the first (left-most) byte, and
To facilitate software implementation, the round-
the 128th (right-most) bit will correspond to the
function d is described in terms of operations on
least significant bit of the 16th (right-most) byte.
words. A sequence of functions fo, fl, . . . , ~~~ is
used in this round-function, where each function f;?
0 < i < 79, takes three words X0, -X.-l and X2 as
- -
9 Dedicated Hash-Function 3
input and produces a single word as output.
The functions fi are defined as follows:
NOTE - This clause contains a description r
r
= (A-[) A A-1 ) v (-a(] A Ah),
fi(hh J-1: L2)
of the round-function, initializing value and
(0 < i < l(3),
padding method for SHA-1 (the US NIST
fi (So , -Sl , Sz ) = s* Y- tj? A~ T & sf!, ( ‘LO < i < N),
‘Secure Hash Algorithm ’), [2].
fj ( So , A-1 , A-2 ) = (A-(] A S,) v (A-(] A A-;) vyxi A S,):
(40 < i < 59);
9.1 General
f; (A-()) x1 ; x3) = A--(] _, x;; x2, (60 < __ i < _ - (9).
In this clause we specify a padding method, an initial-
izing value, and a round-function for use in the general
model described in this part of ISO/IEC 10118. The
9.2.4 Constants
padding method, initializing value and round-function
A sequence of constant words co., cIfl,. . . , cfTc;, is used
specified here, when used in the above general model,
in this round-function. In a hexadecimal representa-
together define Dedicated Hash-Function 3. This ded-
tion (where the most significant bit corresponds to
icated hash-function can be applied to all data strings
the left-most bit) these are defined as follows:
D containing at most 12~’ - 1 bits.
-f
= 5A827999, (0 < i< 19).
The ISO/IEC hash-f unction identifier for Dedicated c
,i - -
f
Hash-Function 3 is equal to 33 (hexadecimal).
6 = GEDSEBAI? (20 < i < i?g>:
- -
i' 1
f
9.2 Parameters, functions and constants
c -/ i = 8FlBBCDC, (40 < i < X)),
- -
9.2.1 Parameters c- = CA62ClD6, (60 < i < 79).
- -
-i
For this hash-function L1 = 51'2 and Lz = 160.
9.2.5 Initializing Value
9.2.2 Byte ordering convention
For this round-function the initializing value, IV, shall
In the specification of the round-function of clause 9 it
always be the following 160-bit string, represented
is assumed that the block input to the round-function
here as a sequence of five words E;, I$,&. YI,? & in a
is in the form of a sequence of words, each 512-bit
hexadecimal representation, where I$ represents the
block being made up of 16 such words. A sequence
left-most 32 of the 160 bits:
of 64 bytes, Bo, B1,. . . , & ‘3 shall be interpreted as
. t
a sequence of 16 words, Zo, Z1,. . e , ZIs, in the fol-
E,b = 67452301,
lowing way. Each group of four consecutive bytes is
1,; = EFCDAB89,
considered as a word, the first byte of a word being
= 98BADCFE,
1;
the most significant byte of that word. Hence
Y3 = 10325476,
= 22"B,i+21"B,1+,+28B,i+2+~~i+3, (0 < i < l*!j>.
Z 1; = C3D2ElFO.
- -
i
To convert the hash-code from a sequence of words 9.3 Padding method
-
to a sequence of bytes, the inverse process shall be
The data string D needs to be padded to make it
followed.
contain a number of bits which is an integer multiple
of 512. The padding procedure operates as follows:
NOTE - The byte-ordering specified here
is different from that of subclause 7.2.2. 1. D is concatenated with a single ‘1’ bit.
@ ISO/IEC
ISO/IEC 10118-3 : 1998 (E)
2. The result of the previous step is concatenated 15, YI, Y2, El>, Yd shall be converted to a sequence
with between zero and 511 ‘0’ bits such that the of 20 bytes using the inverse of the procedure
length (in bits) of the resultant string is congru-
specified in 9.2.2, and where Yo shall yield the
ent to 448 modulo 512. More explicitly, if the first four bytes, E; the next four bytes, and so
original length of D is LD, and letting 1‘ be the
on. Thus the first (left-most) byte will corre-
remainder when L n is divided by 512, then the spond to the most significant byte of Yo, and
number of concatenated zeros is equal to either the 20th (right-most) byte will corespond to the
447 - r (if r 5 4U) or 959 - r (if r > 447). The
least significant byte of YJ. The 20 bytes shall
result will be a bit string whose length will be 64
be converted to a string of 160 bits using the in-
bits short of an integer multiple of 512 bits.
verse of the procedure specified in 6.1, i.e. the
first (left-most) bit will correspond to the most
3. Concatenate the string resulting from the previ-
significant bit of the first (left-most) byte, and
ous step with the 64-bit binary representation of
the 160th (right-most) bit will correspond to the
Lu, most significant bit first.
least significant bit of the 20th (right-most) byte.
In the description of the round-function which follows,
each 512-bit data block Di, 1 5 i 5 QI is treated as
a sequence of 16 words, Zo, Z1,. . . ? ZI,s, where Z.
corresponds to the left-most 32 bits of II;.
9.4 Description of the round-function
The round-function 4 operates as follows. Note
that, in this description, we use the symbols
I/r/; X0, Xl, X-2) X3? X4, Zo, Z1, . . . , Zyg to denote 86
distinct words which contain values required in the
computations.
1. Suppose the 512-bit (first) input to 4 is con-
tained in Zo? Z1,. . . , ZI,s, where Z. contains the
left-most 32 of the 512 bits. Suppose also that
the 160-bit (second) input to 4 is contained in
five words, Yb, Yl i I$, Y& )r ’:j.
2. For i = 16 to 79 let
Z := Sl(Z.i-3 @ Zi-8 @ Zi-l;l @ Zi-lG)*
i
3. Let X0 := 15, Xl := YI , Jy2 : = Y; , Jy3 := y3
and X4 := Yg.
4. For i = 0 to 79 do the following two steps
(a) JV := S5(X()) kJ fi(- ‘i1, -;k ’;!7 -;Lr3) UAY~ UZiU
f
. -
c
(b) 2;’ 4 := x3; X-J := A.,; x-2 := s (X&
:= x0; A-0 :== w.
I
I71
:= &kJX,, Yl := Y~kJX~, 15 := Y&J&,
5. Let YO
:= Y3 ~tl~X-3 and Yd := Yd ~tl Jy_l.
Y3 ?
6. The five words E/b, Y;, Y2, Y ’& Yi represent the
output of the round-function 4. After the fi-
nal iteration of the round-function, the five words
9 .
@ ISO/IEC
ISO/IEC 10118-3 : 1998 (E)
Annex A
(informat~ive)
Exqples
A.1 General
This annex gives examples for the computation of Dedicated Hash-Functions 1, 2 and 3. Nine examples of
hash-code calculation are given for each of the hash-functions. For each of the hash-functions, intermediate
values derived during the hash-function ’s operation are given for examples numbers 3 and 8.
A.2 Dedicated Hash-Function 1
Throughout this annex we refer to ASCII coding of data strings; this is equivalent to coding using IS0 646.
NOTE - Reference [3] contains a pseudocode description of Dedicated Hash-Function 1.
A.2.1 Example 1
In this example the data-string is the empty string, i.e. the string of length zero.
The hash-code is the following 160-bit string.
9C 11 85 A5 C5 E9 FC 54 61 28 08 97 7E E8 F5 48 B2 25 8D 31
A.2.2 Example 2
In this example the data-string consists of a single byte, namely the ASCII-coded version of the letter ‘a ’.
The hash-code is the following 160-bit string.
OB DC 9D 2D 25 6B 3E E9 DA AE 34 7B E6 F4 DC 83 5A 46 7F FE
A.2.3 Example 3
In this example the data-string is the three-byte string consisting of the ASCII-coded version of ‘abc ’. This is
equivalent to the bit-string: ‘01100001 01100010 01100011 ’.
After the padding process, the single 16-word block derived from the data-string is as follows.
80636261 00000000 00000000
00000000 00000000 00000000 00000000 00000000
00000000 00000000 00000000 00000000 00000000 00000000 00000018 00000000
The following are (hexadecimal representations of) the successive values of the variables X0, Xl, -3-2, X3,
x4, x6, x; , x;, x;, AI-;.
67452301, EFCDAB89, 98BADCFE, 10325476, C3D2ElF0, 67452301, EFCDAB89, 98BADCFE, 10325476, C3D2ElFO
C3D2ElF0, 3115FC67, EFCDAB89, EB73FA62, 10325476, C3D2ElF0, DDD63FB8, EFCDAB89, EB73FA62, 10325476
10325476, B41192D5, 3115FC67, 36AE27BF, EB73FA62, 10325476, 322E7AE3, DDD63FB8, 36AE27BF, EB73FA62
EB73FA62, 3A35DC50, B41192D5, 57Fl9CC4, 36AE27BF, EB73FA62, 883EE903, 322E7AE3, 58FEE377, 36AE27BF
@ ISO/IEC ISO/IEC 10118-3 : 1998 (E)
36AE27BF, D3786413, 3A35DC50, 464B56D0, 57Fl9CC4, 36AE27BF, 92B2B79B, 883EE903, B9EB8CC8, 58FEE377
57F19CC4, OE946720, D3786413, D77140E8, 464B56D0, 58FEE377, F909lFF2, 92B2B79B, FBA40E20, B9EB8CC8
464B56D0, D52BF632, OE946720, E1904F4D, D77140E8, B9EB8CC8, E5BO9992, F9091FF2, CADEGE4A, FBA40E20
D77140E8, 150BD8A8, D52BF632, 519C803A, E1904F4D, FBA40E20, 8B2D9FB3, E5B09992, 247FCBE4, CADEGE4A
E1904F4D, 3D6F601F, 150BD8A8, AFD8CB54, 519C803A, CADEGE4A, E755F422, 8B2D9FB3, C2664B96, 247FCBE4
519C803A, B7B60384, 3D6F60lF, 2F62A054, AFD8CB54, 247FCBE4, 5922D09E, E755F422, B67ECE2C, C2664B96
AFD8CB54, B85AOA3F, B7B60384, BD807CF5, 2F62A054, C2664B96, CF24E72C, 5922D09E, 57D08B9D, B67ECE2C
2F62A054, 7F8B38E5, B85AOA3F, D8OEl2DE, BD807CF5, B67ECE2C, CA6AlC75, CF24E72C, 8B427964, 57D08B9D
BD807CF5, 9DACA495, 7F8B38E5, 6828FEE1, D80E12DE, 57D08B9D, 227F6D84, CA6AlC75, 939CB33C, 8B427964
D80E12DE, BC05F46F, 9DACA495, 2CE395FE, 6828FEE1, 8B427964, 5D801685, 227F6D84, A871D729, 939CB33C
6828FEE1, 1494F053, BC05F46F, B2925676, 2CE395FE, 939CB33C, B3C3F4D5, 5D801685, FDB61089, A871D729
2CE395FE, 85861D02, 1494F053, 17DlBEF0, B2925676, A871D729, 3D16242D, B3C3F4D5, 005A1576, FDB61089
B2925676, 597BF629, 85861DO2, 53C14C52, 17DlBEF0, FDB61089, FF459078, 3D16242D, OFD356CF, 005A1576
17DlBEF0, 6347EF78, 597BF629, 18740Al6, 53C14C52, 00561576, 927E40A8, FF459078, 5890B4F4, OFD356CF
53C14C52, 45C8FA44, 6347EF78, EFD8A565, 18740A16, OFD356CF, ACBB994E, 927E40A8, 1641E3FD, 5890B4F4
18740A16, AD2956AF, 45C8FA44, lFBDEl8D, EFD8A565, 5890B4F4, AD30AD24, ACBB994E, F902A249, 1641E3FD
EFD8A565, 5EAFl6B7, AD2956AF, 23E91117, lFBDEl8D, 1641E3FD, 6261732E, AD30AD24, EE653AB2, F902A249
lFBDE18D, 41730D4B, 5EAF16B7, A55ABEB4, 23E91117, F902A249, 45ED27AF, 6261732E, C2B492B4, EE653AB2
23E91117, FCOCCBD3, 41730D4B, BCSADD7A, A55ABEB4, EE653AB2, 243C5668, 45ED27AF, 85CCB989, C2B492B4
A55ABEB4, 042ECC93, FCOCCBD3, CC352D05, BCSADD7A, C2B492B4, 82F89BD1, 243C5668, B49EBDl7, 85CCB989
BC5ADD7A, 4D4D4377, 042ECC93, 332F4FF0, CC352D05, 85CCB989, 5FC74686, 82F89BD1, F159A090, B49EBDl7
CC352D05, 5207002B, 4D4D4377, BB324Cl0, 332F4FF0, B49EBD17, B2720031, 5FC74686, E26F460B, F159A090
332F4FF0, 388278F5, 5207002B, 350DDD35, BB324C10, F159A090, 58AlOOF8, B2720031, lDlA197F, E26F460B
BB324C10, 62879D70, 388278F5, lCOOAD48, 350DDD35, E26F460B, 5992068B, 58AlOOF8, C8OOC6C9, lDlAl97F
350DDD35, A30AlFD9, 62879D70, 09E3D4E2, lCOOAD48, lDlAl97F, CC290DCA, 5992068B, 8403El62, C8OOC6C9
lCOOAD48, BDA2B31B, A30AlFD9, lE75Cl8A, 09E3D4E2, C8OOC6C9, 863D625E, CC290DCA, 481A2D66, 8403El62
09E3D4E2, F7211DEE, BDA2B31B, 287F668C, lE75Cl8A, 8403El62, 6061B5A5, 863D625E, A4372B30, 481A2D66
lE75C18A, B6A665C6, F7211DEE, 8ACC6EF6, 287F668C, 481A2D66, AA98ADB5, 6061B5A5, F5897Al8, A4372B30
287F668C, 2D30FA02, B6A665C6, 8477BBDC, 8ACC6EF6, A4372B30, 2999255A, AA98ADB5, 86D69581, F5897A18
8ACC6EF6, C76D12F9, 2D30FA02, 99971ADA, 8477BBDC, F5897Al8, 98237631, 2999255A, 62B6D6AA, 86D69581
8477BBDC, 516F84DF, C76D12F9, C3E808B4, 99971ADA, 86D69581, 6C472A90, 98237631, 649568A6, 62B6D6AA
99971ADA, F3FA5B05, 516F84DF, B44BE71D, C3E808B4, 62B6D6AA, 2EAD5672, 6C472A90, 8DD8C660, 649568A6
C3E808B4, D539625E, F3FA5B05, BE137D45, B44BE71D, 649568A6, C5CB48BA, 2EAD5672, lCAA41B1, 8DD8C660
B44BE71D, D8500C99, D539625E, E96C17CF, BE137D45, 8DD8C660, 05286DFB, C5CB48BA, B559C8BA, lCAA41Bl
BEl37D45, 7ECDE5B2, D8500C99, E5897B54, E96C17CF, lCAA41B1, 88396DD2, 05286DFB, 2D22EBl7, B559C8BA
E96C17CF, 681D30B9, 7ECDE5B2, 40326761, E5897B54, B559C8BA, 333F2212, 88396DD2, AlB7EC14, 2D22EB17
E5897B54, 960F7BFD, 681D30B9, 3796C9FB, 40326761, 2D22EB17, C699295B, 333F2212, E5B74A20, AlB7ECl4
40326761, 6770E498, 960F7BFD, 74C2E5A0, 3796C9FB, AlB7EC14, BFD68874, C699295B, FC8848CC, E5B74A20
3796C9FB, 75EB06C5, 677OE498, 3DEFF658, 74C2E5A0, E5B74A20, BDDF3474, BFD68874, 64A56FlA, FC8848CC
74C2E5A0, 14FA827A, 75EB06C5, C392619D, 3DEFF658, FC8848CC, 8CBC87E9, BDDF3474, 5A21D2FF, 64A56FlA
3DEFF658, 804B0068, 14FA827A, AClBl5D7, C392619D, 64A56FlA, CDDAGEBF, 8CBC87E9, 7CDlD2F7, 5A21D2FF
C392619D, 475BA8lB, 804B0068, EA09E853, AClB15D7, 5A21D2FF, 656C7DA3, CDDAGEBF, F21FA632, 7CDlD2F7
AClBl5D7, D26BC25D, 475BA8lB, 2COlA201, EA09E853, 7CDlD2F7, 76D66CA3, 656C7DA3, 69BAFF37, F21FA632
EA09E853, DBCSA2CB, D26BC25D, 6EA06DlD, 2COlA201, F21FA632, C9B17F72, 76D66CA3, BlF68D95, 69BAFF37
2COlA201, 77367F5E, DBC5A2CB, AF097749, 6EA06DlD, 69BAFF37, 65860151, C9B17F72, 59B28DDB, BlF68D95
6EA06DlD, 8155A6B4, 77367F5E, 168B2F6F, AF097749, BlF68D95, 33F3AC81, 65A60151, C5FDCB26, 59B28DDB
AF097749, C90C4D38, 8155A6B4, D9FD79DC, 168B2F6F, 59B28DDB, 9BFB827D, 33F3AC81, 98054596, C5FDCB26
168B2F6F, 9762713B, C90C4D38, 569AD205, D9FD79DC, C5FDCB26, DDC8130E, 9BFB827D, CEB204CF, 98054596
D9FD79DC, 7EBF9C32, 9762713B, 3134E324, 569AD205, 98054596, C24C2C79, DDC8130E, EE09F66F, CEB204CF
569AD205, 20EFFAO1, 7EBF9C32, 89C4EE5D, 3134E324, CEB204CF, F255847E, C24C2C79, 204C3B77, EE09F66F
3134E324, 75B7117F, 20EFFAO1, FE70C9FA, 89@4EE5D, EE09F66F, DCD63949, F255847E, 30BlE709, 204C3B77
89C4EE5D, A96BE4C7, 75B7117F, BFE80483, FE70C9FA, 204C3B77, 5B99238D, DCD63949, 5611FBC9, 30BlE709
FE70C9FA, 5E3201FC, A96BE4C7, DC45FDD6, BFE80483, 30BlE709, B43484F4, 5B99238D, 58E52773, 5611FBC9
BFE80483, 2CF95A98, 5E3201FC, AF93lEA5, DC45FDD6, 5611FBC9, 52325809, B43484F4, 648E356E, 58E52773
DC45FDD6, 1393FOC3, 2CF95A98, C807F178, AF931EA5, 58E52773, D015577D, 52325A09, D213D2D0, 648E356E
AF931EA5, BB49CCF7, 1393FOC3, E56A60B3, C807Fl78, 648E356E, BB9C87C4, D015577D, C9682548, D213D2DO
C807F178, 6A33OEB4, BB49CCF7, 4FC30C4E, E56A60B3, D213D2D0, BlBBlA2E, BB9C87C4, 555DF740, C9682548
E56A60B3, 14E58204, 6A330EB4, 2733DEED, 4FC30C4E, C9682548, AC77F96D, BlBBlA2E, 721Fl2EE, 555DF740
4FC30C4E, 79AAF53E, 14E58204, CC3ADlA8, 2733DEED, 555DF740, 1774D326, AC77F96D, EC68BAC6, 721F12EE
2733DEED, 210769B3, 79AAF53E, 96081053, CC3ADlA8, 721Fl2EE, A625Fl12, 1774D326, DFESBGBI, EC68BAC6
CC3ADlA8, F44B53A7, 210769B3, ABD4F9E6, 96081053, EC68BAC6, 5DCA4D12, A625F112, D34C985D, DFESBGBI
ISO/IEC 10118-3 : 1998 (E) @ ISO/lEC
I
96081053, 7ClE3640, F44B53A7, lDA6CC84, ABD4F9E6, DFE5BGB1, EBC4D9C6, 5DCA4Dl2, 97C44A98, D34C985D
ABD4F9E6, 06B59EE8, 7ClE3640, 2D4E9FD1, lDA6CC84, D34C985D, 095F37FD, EBC4D9C6, 29344977, 97C44AW
lDA6CC84, C422C3CD, 06B59EE8, 78D90lF0, 2D4E9FD1, 97644A98, 5BBEE487, 095F37FD, 1367lBAF, 29344977
2D4E9FD1, AD864025, C422C3CD, D67BAOlA, 78D90lF0, 29344977, BF5B2529, 5BBEE487, 7CDFF425, 1367lBAF
78D90lF0, 29A83BB5, AD864025, 8BOF3710, D67BAOlA, 1367lBAF, FB5747C5, BFSB2529, FB92lD6E, 7CDFF425
D67BAOlA, 626E3910, 29A83BB5, 190096B6, 8BOF3710, 7CDFF425, DD935A5F, FB5747C5, 6C94A6FD, FB92lD6E
8BOF3710, A719D8BC, 626E3910, AOEED4A6, 190096B6, FB92lD6E, 27754F3A, DD935A5F, 5DlFl7ED, 6C94A6FD
190096B6, BA84C782, A719D8BC, B8E44189, AOEED4A6, 6C94A6FD, 4F5CA4A5, 27754F3A, 4D697F76, 5DlFl7ED
AOEEDLZAG, 9F6887A9, BA84C782, 6762F29C, B8E44189, 5DlFl7ED, 325AFE7E, 4F5CA4A5, D53CE89D, 4D697F76
B8E44189, 3A88288C, 9F6887A9, 13lEOAEA, 6762F29C, 4D697F76, 86AFE021, 325AFE7E, 7292953D, D53CE89D
6762F29C, AB23F78F, 3A88288C, A2lEA67D, 13lEOAEA, D53CE89D, C97F9EA1, 86AFE021, 6BF9F8C9, 7292953D
13lEOAEA, 7299044A, AB23F78F, 20A230EA, A2lEA67D, 7292953D, 9F6075lC, C97F9EA1, BF808618, 6BF9F8C9
A2lEA67D, 6A3FlOCF, 72990448, 8FDE3EAC, 20A230EA, 6BF9F8C9, lE9CE713, 9F6075lC, FE7A8725, BF8086lA
20A230EA, lAlB904D, 6A3FlOCF, 641129CA, 8FDE3EAC, BF8086lA, Cl3F038A, lE9CE713, 8lD4727D, FE7A8725
8FDE3EAC, OB2CDCO1, lAlB904D, FC433DA8, 641129CA, FE7A8725, BF627814, Cl3F038A, 739C4C7A, 8lD4727D
641129CA, D563BFDC, OB2CDCO1, 6E413468, FC433DA8, 8lD4727D, SFCCBADE, BF627814, FCOE2B04, 739C4C7A
The hash-code is the following 160-bit string.
8E B2 08 F7 EO SD 98 7A 9B 04 4A 8E 98 C6 BO 87 Fl 5A OB FC
A.2.4 Example 4
In this example the data-string is the 14-byte string consisting of the ASCII-coded version of
‘message digest’
The hash-code is the following 160-bit string.
5D 06 89 EF 49 D2 FA E5 72 B8 81 Bl 23 A8 5F FA 21 59 5F 36
A.2.5 Example 5
In this example the data-string is the 26-byte string consisting of the ASCII-coded version of
‘abcdefghijklmnopqrstuvwxyz
The hash-code is the following 160-bit string.
F7 1C 27 10 9C 69 2C 1B 56 BB DC EB 5B 9D 28 65 B3 70 8D BC
A.2.6 Example 6
In this example the data-string is the 62-byte string consisting of the ASCII-coded version of
‘ABCDEFGHIJKLMNOPQRSTUVWXYZ a b c d e f g h ”IJ kl mnopqrstuvwxyz0123456789’
The hash-code is the following 160-bit string
BO E2 OB 6E 31 16 64 02 86 ED 3A 87 A5 71 30 79 B2 1F 51 89
@ ISO/IEC ISO/IEC 10118-3 : 1998 (E)
A.2.7 Example 7
In this example the data-string is the 80-byte string consisting of the ASCII-coded version of eight repetitions
of
‘1234567890'
The hash-code is the following 160-bit string.
9B 75 2E 45 57 3D 4B 39 F4 DB D3 32 3C AB 82 BF 63 32 6B FB
A.2.8 Example 8
In this example the data-string is the 56-byte string consisting of the ASCII-coded version of
‘abcdbcdecdefdefgefghfghighijhijkijkljkImklmnImnomnopnopq’
After the padding process, the two 16-word blocks derived from the data-string are as follows
6B6A6968
64636261 65646362 66656463 67666564 68676665 69686766 6A696867
6C6B6A69 6D6C6B6A 6E6D6C6B 6F6E6D6C 706F6E6D 71706F6E 00000080 00000000
00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
00000000 00000000
00000000 00000000 00000000 00000000 00000000 000001c0
The following are (hexadecimal representations of) the successive values of the variables X0, XI, X2, X3,
x-4, s;, x; p x-;, x;, x-; f obtained during the processing of the first block.
67452301, EFCDAB89, 98BADCFE, 10325476, C3D2ElF0, 67452301, EFCDAB89, 98BADCFE, 10325476, C3D2ElFO
C3D2ElF0, 3115FB87, EFCDAB89, EB73FA62, 10325476, C3D2ElF0, 463DA521, EFCDAB89, EB73FA62, 10325476
10325476, CC2lEC2E, 3115FB87, 36AE27BF, EB73FA62, 10325476, DB247A12, 463DA521, 36AE27BF, EB73FA62
EB73FA62, DFEBSB7A, CC21EC2E, 57EElCC4, 36AE27BF, EB73FA62, lD166A23, DB247A12, F6948518, 36AE27BF
36AE27BF, 2363912E, DFEBSB7A, 87BOBB30, 57EElCC4, 36AE27BF, CE7A12F6, lD166A23, 91E84B6C, F6948518
57EElCC4, AlB60DC7, 2363912E, AEGDEB7F, 87BOBB30, F6948518, 57FF19DD, CE7A12F6, 59A88C74, 91E84B6C
87BOBB30, 96AC7ClE, AlB60DC7, 8E44B88D, AEGDEB7F, 9lE84B6C, OIASFEFA, 57FF19DD, E84BDB39, 59A88674
AEGDEB7F, 6AE46154, 96AC7ClE, D8371E86, 8E44B88D, 59A88C74, 5D9A609C, OIASFEFA, FC67755F, E84BDB39
8E44B88D, 3CF61F09, 6AE46154, BlF07A5A, D8371E86, E84BDB39, 030F7FE7, 5D9A609C, A7FBE806, FC67755F
D8371E86, 696FOD9A, 3CF61F09, 918551AB, BlF07A5A, FC67755F, 7456C8E3, 030F7FE7, 69827176, A7FBE806
BlF07A5A, AB957B91, 696FOD9A, D87C24F3, 918551AB, A7FBE806, F64C4453, 7456C8E3, 3DFFSCOC, 69827176
918551AB, 9FF4A064, AB957B91, BC3669A5, D87C24F3, 69827176, 22ASFE6E, F64C4453, 5B238DD1, 3DFFSCOC
D87C24F3, 912FE998, 9FF4A064, 55EE46AE, BC3669A5, 3DFFSCOC, 8D7E53E4, 22A5FE6E, 31114FD9, 5B238DDl
BC3669A5, C45F164E, 912FE998, D281927F, 55EE46AE, 5B238DD1, 695B23B7, 8D7E53E4, 97F9B88A, 31114FD9
55EE46AE, 2211A508, C45F164E, BFA66244, D281927F, 31114FD9, 6FAA776F, 695B23B7, F94F9235, 97F9B88A
D281927F, 80BlF3DE, 2211A508, 7C593B11, BFA66244, 97F9B88A, 4D94F720, 6FAA776F, 6C8EDDA5, F94F9235
BFA66244, 3AA6A8F5, 80BlF3DE, 46942088, 7C593Bl1, F94F9235, D81C6137, 4D94F720, ASDDBDBE, 6C8EDDA5
7C593Bl1, 9E4C4BF6, 3AA6A8F5, C7CF7A02, 46942088, 6C8EDDA5, B2ECCABD, D81C6137, 53DC8136, ASDDBDBE
46942088, F929216E, 9E4C4BF6, 9AA3D4EA, C7CF7A02, ASDDBDBE, A96Bl820, B2ECCABD, 7184DF60, 53DC8136
C7CF7A02, DSAEEFAF, F929216E, 312FDA79, 9AA3D4EA, 53DC8136, 5A5E09B3, A96B1820, B32AF6CB,
...