1、raising standards worldwide NO COPYING WITHOUT BSI PERMISSION EXCEPT AS PERMITTED BY COPYRIGHT LAW BSI Standards Publication BS ISO/IEC 10118-2:2010 Information technology Security techniques Hash-functions Part 2: Hash-functions using an n-bit block cipher Incorporating corrigendum December 2011BS
2、ISO/IEC 10118-2:2010 BRITISH STANDARD National foreword This British Standard is the UK implementation of ISO/IEC 10118-2:2010, incorporating corrigendum December 2011. The UK participation in its preparation was entrusted to Technical Committee IST/33, IT - Security techniques. A list of organizati
3、ons represented on this committee can be obtained on request to its secretary. This publication does not purport to include all the necessary provisions of a contract. Users are responsible for its correct application. The British Standards Institution 2012 ISBN 978 0 580 76008 2 ICS 35.040 Complian
4、ce with a British Standard cannot confer immunity from legal obligations. This British Standard was published under the authority of the Standards Policy and Strategy Committee on 30 November 2010. Amendments/corrigenda issued since publication Date Text affected 31 January 2012 Implementation of IS
5、O/IEC corrigendum December 2011: Amended Annex B.3 Padding methods 1 and 2 Reference number ISO/IEC 10118-2:2010(E) ISO/IEC 2010INTERNATIONAL STANDARD ISO/IEC 10118-2 Third edition 2010-10-15 Information technology Security techniques Hash-functions Part 2: Hash-functions using an n-bit block cipher
6、 Technologies de linformation Techniques de scurit Fonctions de brouillage Partie 2: Fonctions de brouillage utilisant un chiffrement par blocs de n bits BS ISO/IEC 10118-2:2010 ISO/IEC 10118-2:2010 (E) PDF disclaimer This PDF file may contain embedded typefaces. In accordance with Adobes licensing
7、policy, this file may be printed or viewed but shall not be edited unless the typefaces which are embedded are licensed to and installed on the computer performing the editing. In downloading this file, parties accept therein the responsibility of not infringing Adobes licensing policy. The ISO Cent
8、ral Secretariat accepts no liability in this area. Adobe is a trademark of Adobe Systems Incorporated. Details of the software products used to create this PDF file can be found in the General Info relative to the file; the PDF-creation parameters were optimized for printing. Every care has been tak
9、en to ensure that the file is suitable for use by ISO member bodies. In the unlikely event that a problem relating to it is found, please inform the Central Secretariat at the address given below. COPYRIGHT PROTECTED DOCUMENT ISO/IEC 2010 All rights reserved. Unless otherwise specified, no part of t
10、his publication may be reproduced or utilized in any form or by any means, electronic or mechanical, including photocopying and microfilm, without permission in writing from either ISO at the address below or ISOs member body in the country of the requester. ISO copyright office Case postale 56 CH-1
11、211 Geneva 20 Tel. + 41 22 749 01 11 Fax + 41 22 749 09 47 E-mail copyrightiso.org Web www.iso.org Published in Switzerland ii ISO/IEC 2012 All rights reservedBS ISO/IEC 10118-2:2010 ISO/IEC 10118-2:2010 (E) ISO/IEC 2012 All rights reserved iiiContents Page Foreword .v Introductionvi 1 Scope1 2 Norm
12、ative references1 3 Terms and definitions .1 4 Symbols and abbreviated terms 2 5 Use of the general model2 6 Hash-function 1 .2 6.1 General .2 6.2 Parameter selection 2 6.3 Padding method 3 6.4 Initializing value.3 6.5 Round function 3 6.6 Output transformation 4 7 Hash-function 2 .4 7.1 General .4
13、7.2 Parameter selection 4 7.3 Padding method 4 7.4 Initializing value.4 7.5 Round function 4 7.6 Output transformation 5 8 Hash-function 3 .6 8.1 General .6 8.2 Parameter selection 6 8.3 Padding method 6 8.4 Initializing value.6 8.5 Round function 6 8.6 Output transformation 9 9 Hash-function 4 .9 9
14、1 General .9 9.2 Parameter selection 9 9.3 Padding method 9 9.4 Initializing value.9 9.5 Round function 9 9.6 Output transformation 11 Annex A (informative) Use of AES.13 A.1 General .13 A.2 Hash-function 1 .13 A.3 Hash-function 2 .13 A.4 Hash-function 3 .13 A.5 Hash-function 4 .14 Annex B (informa
15、tive) Examples .15 B.1 General .15 B.2 Hash-function 1 .15 B.3 Hash-function 2 .16 B.4 Hash-function 3 .17 BS ISO/IEC 10118-2:2010 ISO/IEC 10118-2:2010 (E) iv ISO/IEC 2012 All rights reservedB.5 Hash-function 422 Annex C (normative) ASN.1 Module27 Bibliography 29 BS ISO/IEC 10118-2:2010 ISO/IEC 1011
16、8-2:2010 (E) ISO/IEC 2012 All rights reserved vForeword ISO (the International Organization for Standardization) and IEC (the International Electrotechnical Commission) form the specialized system for worldwide standardization. National bodies that are members of ISO or IEC participate in the develo
17、pment of International Standards through technical committees established by the respective organization to deal with particular fields of technical activity. ISO and IEC technical committees collaborate in fields of mutual interest. Other international organizations, governmental and non-government
18、al, in liaison with ISO and IEC, also take part in the work. In the field of information technology, ISO and IEC have established a joint technical committee, ISO/IEC JTC 1. International Standards are drafted in accordance with the rules given in the ISO/IEC Directives, Part 2. The main task of the
19、 joint technical committee is to prepare International Standards. Draft International Standards adopted by the joint technical committee are circulated to national bodies for voting. Publication as an International Standard requires approval by at least 75 % of the national bodies casting a vote. IS
20、O/IEC 10118-2 was prepared by Joint Technical Committee ISO/IEC JTC 1, Information technology, Subcommittee SC 27, IT Security techniques. This third edition cancels and replaces the second edition (ISO/IEC 10118-2:2000), which has been technically revised. It also incorporates the Technical Corrige
21、ndum ISO/IEC 10118-2:2000/Cor.2:2007. The major change is that in the second edition the underlying block cipher used in the hash-functions was assumed to be Data Encryption Algorithm (DEA), whereas in the third edition it is assumed to be more secure block ciphers like Advanced Encryption Standard
22、AES) and other ciphers included in ISO/IEC 18033-3. ISO/IEC 10118 consists of the following parts, under the general title Information technology Security techniques Hash-functions: Part 1: General Part 2: Hash-functions using an n-bit block cipher Part 3: Dedicated hash-functions Part 4: Hash-func
23、tions using modular arithmetic BS ISO/IEC 10118-2:2010 ISO/IEC 10118-2:2010 (E) vi ISO/IEC 2012 All rights reservedIntroduction The International Organization for Standardization (ISO) and International Electrotechnical Commission (IEC) draw attention to the fact that it is claimed that compliance w
24、ith this document may involve the use of patents. The ISO and IEC take no position concerning the evidence, validity and scope of these patent rights. The holders of these patent rights have assured the ISO and IEC that they are willing to negotiate licences under reasonable and non-discriminatory t
25、erms and conditions with applicants throughout the world. In this respect, the statements of the holders of these patent rights are registered with the ISO and IEC. Information may be obtained from the ISO/IEC JTC 1 Patent database: http:/www.iso.org/patents Attention is drawn to the possibility tha
26、t some of the elements of this document may be the subject of patent rights other than those identified above. ISO and IEC shall not be held responsible for identifying any or all such patent rights. BS ISO/IEC 10118-2:2010 INTERNATIONAL STANDARD ISO/IEC 10118-2:2010 (E) ISO/IEC 2012 All rights rese
27、rved 1Information technology Security techniques Hash-functions Part 2: Hash-functions using an n-bit block cipher 1 Scope This part of ISO/IEC 10118 specifies hash-functions which make use of an n-bit block cipher algorithm. They are therefore suitable for an environment in which such an algorithm
28、is already implemented. Four hash-functions are specified. The first provides hash-codes of length less than or equal to n, where n is the block-length of the underlying block cipher algorithm used. The second provides hash-codes of length less than or equal to 2n; the third provides hash-codes of l
29、ength equal to 2n; and the fourth provides hash-codes of length 3n. All four of the hash-functions specified in this part of ISO/IEC 10118 conform to the general model specified in ISO/IEC 10118-1. 2 Normative references The following referenced documents are indispensable for the application of thi
30、s document. For dated references, only the edition cited applies. For undated references, the latest edition of the referenced document (including any amendments) applies. ISO/IEC 10118-1:2000, Information technology Security techniques Hash-functions Part 1: General 3 Terms and definitions For the
31、purposes of this document, the terms and definitions given in ISO/IEC 10118-1 and the following apply. 3.1 block string of bits of defined length 3.2 n-bit block cipher block cipher with the property that plaintext blocks and ciphertext blocks are n bits in length ISO/IEC 18033-3:2005 3.3 round func
32、tion function (.,.) that transforms two binary strings of lengths L 1and L 2to a binary string of length L 2NOTE The round function is used iteratively. BS ISO/IEC 10118-2:2010 ISO/IEC 10118-2:2010 (E) 2 ISO/IEC 2012 All rights reserved4 Symbols and abbreviated terms For the purposes of this documen
33、t, the symbols and abbreviated terms given in ISO/IEC 10118-1 and the following apply. B LWhen n is even, the string composed of the n/2 leftmost bits of the block B. When n is odd, the string composed of the (n+1)/2 leftmost bits of the block B B RWhen n is even, the string composed of the n/2 righ
34、tmost bits of the block B. When n is odd, the string composed of the (n-1)/2 rightmost bits of the block B B xWhen B is a sequence of blocks and each block has m bits, B x( x0) represents the x-th block of B. E K (P) n-bit block cipher algorithm taking the key K and plaintext P as input. It is recom
35、mended that the block cipher algorithms specified in ISO/IEC 18033-3 are used in the hash-functions. K Key for the algorithm E u or u Function which takes as input an n-bit block and gives as output a key for the algorithm E. 5 Use of the general model The hash-functions specified in the next four c
36、lauses provide hash-codes H of length L H . The hash-functions conform to the general model specified in ISO/IEC 10118-1. For each of the four hash-functions that follow, it is therefore only necessary to specify the parameters L 1 , L 2 , L H , the padding method, the initializing value IV, the rou
37、nd function , the output transformation T. 6 Hash-function 1 6.1 General The hash-function specified in this clause provides hash-codes of length L 1and L 2where L 1and L 2are equal to n. Some specific definitions that are required to specify hash-function 1 follow. NOTE This hash-function is descri
38、bed in 5. 6.2 Parameter selection The parameters L 1 , L 2and L Hfor the hash-function specified in this clause shall satisfy L 1= L 2= n, and L His less than or equal to n. ISO/IEC 2012 All rights reserved 36.3 Padding method The selection of the padding method for use with this hash-function is be
39、yond the scope of this part of ISO/IEC 10118. As minimum requirements, the padding method shall output a set of q blocks D 1 , D 2 , ., D qwhere each block D jis of length n and shall be such that each possible input produces distinct outputs. Examples of padding methods are presented in ISO/IEC 101
40、18-1:2000, Annex A. 6.4 Initializing value The selection of the IV for use with this hash-function is beyond the scope of this part of ISO/IEC 10118. The IV shall be a bit-string of length n and the value of the IV shall be agreed upon and fixed by users of the hash-function. 6.5 Round function Tran
41、sformation u: Define a mapping u from the ciphertext space. The round function combines a padded data block D j(of L 1= n-bits) with H j-1 , the previous output of the round function (of L 2= n bits), to yield H j . As part of the round function it is necessary to choose a function u, which transfor
42、ms an n-bit block into a key for use with the block cipher algorithm E. The selection of the function u for use with this hash-function is outside the scope of this part of ISO/IEC 10118. The round function itself is defined as follows: Set H 0equal to IV (D j , H j-1 ) = E Kj(D j ) D j where K j= u
43、 (H j-1 ). The round function is shown in Figure 1. Figure 1 Round function of hash-function 1 E u H j-1K jD jH jBS ISO/IEC 10118-2:2010 ISO/IEC 10118-2:2010 (E) 4 ISO/IEC 2012 All rights reserved6.6 Output transformation The output transformation T is simply truncation, i.e., the hash-code H is der
44、ived by taking the leftmost L Hbits of the final output block H q . 7 Hash-function 2 7.1 General The hash-function specified in this clause provides hash-codes of length L 1and L 2 where L 1is equal to n and L 2is equal to 2n. Some specific definitions that are required to specify hash-function 2 f
45、ollow. NOTE 1 This hash-function is described in 4. NOTE 2 In 6, theoretical attacks on hash-function 2 have been reported: a collision attack, with n = 128, which has complexity 2 124.5 , and a preimage attack requiring complexity and space about 2 n . The only reason to keep hash-function 2 in thi
46、s part of ISO/IEC 10118 is for compatibility with the existing applications. 7.2 Parameter selection The parameters L 1 , L 2and L Hfor the hash-function specified in this clause shall satisfy L 1= n, L 2= 2n, and L His less than or equal to 2n. 7.3 Padding method The selection of the padding method
47、 for use with this hash-function is beyond the scope of this part of ISO/IEC 10118. As minimum requirements, the padding method shall output a set of q blocks D 1 , D 2 , ., D qwhere each block D jis of length n and shall be such that each possible input produces distinct outputs. Examples of paddin
48、g methods are presented in ISO/IEC 10118-1:2000, Annex A. 7.4 Initializing value The selection of the IV (of length 2n) for use with this hash-function is beyond the scope of this part of ISO/IEC 10118. The IV shall be a bit-string of length 2n and the value of the IV shall be agreed upon and fixed
49、by users of the hash-function. However, the IV shall be selected such that u(IV L) and u (IV R ) are different. 7.5 Round function The round function combines a padded data block D j(of L 1= n bits) with H j-1 , the previous output of the round function (of L 2= 2n bits), to yield H j . As part of the round function it is necessary to choose two transformations u and u. These transformations are used to transform an output block into two suitable L Kbit keys for
