PHP supports hashing of the following Tiger algorithms:

  • tiger128,3
  • tiger160,3
  • tiger192,3
  • tiger128,4
  • tiger160,4
  • tiger192,4

Wikipedia's entry on Tiger says there's Tiger and Tiger2 and provides samples of Tiger and Tiger2 with 192-bit hashes of "The quick brown fox jumps over the lazy dog". So I tried to get PHP to tell me what the hashes of tiger192,3 and tiger192,4 are and...

The output of tiger192,3 matches what Wikipedia says the output is for Tiger(1). But tiger192,4's output does not match the output for Tiger2.

Tiger2's output is as follows:


tiger192,4's output is as follows:


tiger192,3 and Tiger's output is as follows:


So what is tiger192,4?


A quick look into the PHP code showed that PHP only understands the Tiger hash (the first one with incorrect bit padding).

It also showed that their implementation of Tiger may contain "additional passes", where each pass consists of 8 rounds (only called for values higher than 3). The value of passes is displayed behind the hash function:

#define compress(passes) \
    save_abc \
    pass(a,b,c,5) \
    key_schedule \
    pass(c,a,b,7) \
    key_schedule \
    pass(b,c,a,9) \
    for(pass_no=0; pass_no<passes; pass_no++) { \ <- additional rounds start here
        key_schedule \
        pass(a,b,c,9) \
        tmpa=a; a=c; c=b; b=tmpa; \
    } \

There seems to be no documentation other than this. Don't use cryptographic primitives that lack any description.

I've generated the same C1... hash by adding the 8 additional rounds in a Java application (and then deleted said Java implementation).

| improve this answer | |
  • 2
    $\begingroup$ Note that attacks have been found on Tiger up to 22 rounds (OK, using around $2^{64}$ memory). That's however too close for comfort, this may have been an ill advised method of fixing that. Or an attempt to create a password hashing function with many iterations - who knows? $\endgroup$ – Maarten Bodewes Sep 6 '15 at 15:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.