4
$\begingroup$

PHP supports hashing of the following Tiger algorithms:

  • tiger128,3
  • tiger160,3
  • tiger192,3
  • tiger128,4
  • tiger160,4
  • tiger192,4

Wikipedia's entry on Tiger says there's Tiger and Tiger2 and provides samples of Tiger and Tiger2 with 192-bit hashes of "The quick brown fox jumps over the lazy dog". So I tried to get PHP to tell me what the hashes of tiger192,3 and tiger192,4 are and...

The output of tiger192,3 matches what Wikipedia says the output is for Tiger(1). But tiger192,4's output does not match the output for Tiger2.

Tiger2's output is as follows:

976abff8062a2e9dcea3a1ace966ed9c19cb85558b4976d8

tiger192,4's output is as follows:

c1f3a704e9f6267e9f75fa47191f83c354100a04c4f1dc6f

tiger192,3 and Tiger's output is as follows:

6d12a41e72e644f017b6f0e2f7b44c6285f06dd5d2c5b075

So what is tiger192,4?

$\endgroup$
3
$\begingroup$

A quick look into the PHP code showed that PHP only understands the Tiger hash (the first one with incorrect bit padding).

It also showed that their implementation of Tiger may contain "additional passes", where each pass consists of 8 rounds (only called for values higher than 3). The value of passes is displayed behind the hash function:

#define compress(passes) \
    save_abc \
    pass(a,b,c,5) \
    key_schedule \
    pass(c,a,b,7) \
    key_schedule \
    pass(b,c,a,9) \
    for(pass_no=0; pass_no<passes; pass_no++) { \ <- additional rounds start here
        key_schedule \
        pass(a,b,c,9) \
        tmpa=a; a=c; c=b; b=tmpa; \
    } \
    feedforward

There seems to be no documentation other than this. Don't use cryptographic primitives that lack any description.


I've generated the same C1... hash by adding the 8 additional rounds in a Java application (and then deleted said Java implementation).

| improve this answer | |
$\endgroup$
  • 2
    $\begingroup$ Note that attacks have been found on Tiger up to 22 rounds (OK, using around $2^{64}$ memory). That's however too close for comfort, this may have been an ill advised method of fixing that. Or an attempt to create a password hashing function with many iterations - who knows? $\endgroup$ – Maarten Bodewes Sep 6 '15 at 15:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.