RIPEMD

Cryptographic hash function

RIPEMDGeneral

Designers| Hans Dobbertin, Antoon Bosselaers and Bart Preneel
First published| 1992
Certification| RIPEMD-160: CRYPTREC (Monitored)
Detail
Digest sizes| 128, 160, 256, 320 bits
A sub-block from the compression function of the RIPEMD-160 hash algorithm

RIPEMD (RIPE Message Digest) is a family of cryptographic hash functions developed in 1992 (the original RIPEMD) and 1996 (other variants). There are five functions in the family: RIPEMD, RIPEMD-128, RIPEMD-160, RIPEMD-256, and RIPEMD-320, of which RIPEMD-160 is the most common.

The original RIPEMD, as well as RIPEMD-128, is not considered secure because 128-bit result is too small and also (for the original RIPEMD) because of design weaknesses. The 256- and 320-bit versions of RIPEMD provide the same level of security as RIPEMD-128 and RIPEMD-160, respectively; they are designed for applications where the security level is sufficient but longer hash result is necessary.

While RIPEMD functions are less popular than SHA-1 and SHA-2, they are used, among others, in Bitcoin and other cryptocurrencies based on Bitcoin.

## History[edit]

The original RIPEMD function was designed in the framework of the EU project RIPE (RACE Integrity Primitives Evaluation) in 1992.[1][2] Its design was based on the MD4 hash function. In 1996, in response to security weaknesses found in the original RIPEMD,[3] Hans Dobbertin, Antoon Bosselaers and Bart Preneel at the COSIC research group at the Katholieke Universiteit Leuven in Leuven, Belgium published four strengthened variants: RIPEMD-128, RIPEMD-160, RIPEMD-256, and RIPEMD-320.[4]

In August 2004, a collision was reported for the original RIPEMD.[5] This does not apply to RIPEMD-160.[6]

In 2019, the best collision attack for RIPEMD-160 could reach 34 rounds out of 80 rounds, which was published at CRYPTO 2019.[7]

In February 2023, a collision attack for RIPEMD-160 was published at EUROCRYPT 2023, which could reach 36 rounds out of 80 rounds with time complexity of 264.5.[8]

In December 2023, an improved collision attack was found based on the technique from the previous best collision attack, this improved collision attack could reach 40 rounds out of 80 round with a theoretical time complexity of 249.9.[9]

## RIPEMD-160 hashes[edit]

The 160-bit RIPEMD-160 hashes (also termed RIPE message digests) are typically represented as 40-digit hexadecimal numbers. The following demonstrates a 43-byte ASCII input and the corresponding RIPEMD-160 hash:

RIPEMD-160("The quick brown fox jumps over the lazy dog") =
37f332f68db77bd9d7edd4969571ad671cf9dd3b

RIPEMD-160 behaves with the desired avalanche effect of cryptographic hash functions (small changes, e.g. changing d to c, result in a completely different hash):

RIPEMD-160("The quick brown fox jumps over the lazy cog") =
132072df690933835eb8b6ad0b77e7b6f14acad7

The hash of a zero-length string is:

RIPEMD-160("") =
9c1185a5c5e9fc54612808977ee8f548b2258d31

## Implementations[edit]

Below is a list of cryptography libraries that support RIPEMD (specifically RIPEMD-160):

* Botan
* Bouncy Castle
* Cryptlib
* Crypto++
* Libgcrypt
* mbed TLS
* Nettle
* OpenSSL
* wolfSSL

## See also[edit]

* Hash function security summary
* Comparison of cryptographic hash functions
* Comparison of cryptography libraries
* Topics in cryptography

## References[edit]

1. ^ Dobbertin, Hans; Bosselaers, Antoon; Preneel, Bart (21–23 February 1996). RIPEMD-160: A strengthened version of RIPEMD (PDF). Fast Software Encryption. Third International Workshop. Cambridge, UK. pp. 71–82. doi:10.1007/3-540-60865-6_44.
2. ^ Bosselaers, Antoon; Preneel, Bart (1995). Bosselaers, Antoon; Preneel, Bart (eds.). Integrity Primitives for Secure Information Systems. Final Report of RACE Integrity Primitives Evaluation (RIPE-RACE 1040). Lecture Notes in Computer Science. Vol. 1007\. doi:10.1007/3-540-60640-8. ISBN 978-3-540-60640-6. S2CID 12895857.
3. ^ Dobbertin, Hans (December 1997). "RIPEMD with two-round compress function is not collision-free". Journal of Cryptology. 10 (1): 51–69. doi:10.1007/s001459900019. S2CID 15662054.
4. ^ Bosselaers, Antoon. "The hash function RIPEMD-160".
5. ^ Wang, Xiaoyun; Feng, Dengguo; Lai, Xuejia; Yu, Hongbo (2004-08-17). "Collisions for Hash Functions MD4, MD5, HAVAL-128 and RIPEMD". Cryptology ePrint Archive. Retrieved 2017-03-03.
6. ^ Mendel, Florian; Pramstaller, Norbert; Rechberger, Christian; Rijmen, Vincent (2006). "On the Collision Resistance of RIPEMD-160". Information Security. Lecture Notes in Computer Science. Vol. 4176\. pp. 101–116. doi:10.1007/11836810_8. ISBN 978-3-540-38341-3. Retrieved 2017-03-03.
7. ^ Liu, Fukang; Dobraunig, Christoph; Mendel, Florian; Isobe, Takanori; Wang, Gaoli; Cao, Zhenfu (2019). "Efficient Collision Attack Frameworks for RIPEMD-160". Advances in Cryptology – CRYPTO 2019. Lecture Notes in Computer Science. Vol. 11693\. pp. 117–149. doi:10.1007/978-3-030-26951-7_5. ISBN 978-3-030-26950-0. S2CID 51860634. `{{cite book}}`: `|journal=` ignored (help)
8. ^ Liu, Fukang; Wang, Gaoli; Sarkar, Santanu; Anand, Ravi; Meier, Willi; Li, Yingxin; Isobe, Takanori (February 2023). "Analysis of RIPEMD-160: New Collision Attacks and Finding Characteristics with MILP". Advances in Cryptology – EUROCRYPT 2023. Lecture Notes in Computer Science. Vol. 14007\. pp. 189–219. doi:10.1007/978-3-031-30634-1_7. ISBN 978-3-031-30633-4. S2CID 257235244. `{{cite book}}`: `|journal=` ignored (help)
9. ^ Li, Yingxin; Liu, Fukang; Wang, Gaoli (2023-12-08). "Automating Collision Attacks on RIPEMD-160". IACR Transactions on Symmetric Cryptology. 2023 (4): 112–142. doi:10.46586/tosc.v2023.i4.112-142. ISSN 2519-173X.

## External links[edit]

* The hash function RIPEMD-160
* RIPEMD-160 Ecrypt page
* RIPEMD-128bit Algorithm

* v
* t
* e

Cryptographic hash functions and message authentication codes

* List
* Comparison
* Known attacks

Common functions|

* MD5 (compromised)
* SHA-1 (compromised)
* SHA-2
* SHA-3
* BLAKE2

SHA-3 finalists|

* BLAKE
* Grøstl
* JH
* Skein
* Keccak (winner)

Other functions|

* BLAKE3
* CubeHash
* ECOH
* FSB
* Fugue
* GOST
* HAS-160
* HAVAL
* Kupyna
* LSH
* Lane
* MASH-1
* MASH-2
* MD2
* MD4
* MD6
* MDC-2
* N-hash
* RIPEMD
* RadioGatún
* SIMD
* SM3
* SWIFFT
* Shabal
* Snefru
* Streebog
* Tiger
* VSH
* Whirlpool

Password hashing/
key stretching functions|

* Argon2
* Balloon
* bcrypt
* Catena
* crypt
* LM hash
* Lyra2
* Makwa
* PBKDF2
* scrypt
* yescrypt

General purpose
key derivation functions|

* HKDF
* KDF1/KDF2

MAC functions|

* CBC-MAC
* DAA
* GMAC
* HMAC
* NMAC
* OMAC/CMAC
* PMAC
* Poly1305
* SipHash
* UMAC
* VMAC

Authenticated
encryption modes|

* CCM
* ChaCha20-Poly1305
* CWC
* EAX
* GCM
* IAPM
* OCB

Attacks|

* Collision attack
* Preimage attack
* Birthday attack
* Brute-force attack
* Rainbow table
* Side-channel attack
* Length extension attack

Design|

* Avalanche effect
* Hash collision
* Merkle–Damgård construction
* Sponge function
* HAIFA construction

Standardization|

* CAESAR Competition
* CRYPTREC
* NESSIE
* NIST hash function competition
* Password Hashing Competition

Utilization|

* Hash-based cryptography
* Merkle tree
* Message authentication
* Proof of work
* Salt
* Pepper

* v
* t
* e

Cryptography

General|

* History of cryptography
* Outline of cryptography
* Cryptographic protocol
* Authentication protocol
* Cryptographic primitive
* Cryptanalysis
* Cryptocurrency
* Cryptosystem
* Cryptographic nonce
* Cryptovirology
* Hash function
* Cryptographic hash function
* Key derivation function
* Digital signature
* Kleptography
* Key (cryptography)
* Key exchange
* Key generator
* Key schedule
* Key stretching
* Keygen
* Cryptojacking malware
* Ransomware
* Random number generation
* Cryptographically secure pseudorandom number generator (CSPRNG)
* Pseudorandom noise (PRN)
* Secure channel
* Insecure channel
* Subliminal channel
* Encryption
* Decryption
* End-to-end encryption
* Harvest now, decrypt later
* Information-theoretic security
* Plaintext
* Codetext
* Ciphertext
* Shared secret
* Trapdoor function
* Trusted timestamping
* Key-based routing
* Onion routing
* Garlic routing
* Kademlia
* Mix network

Mathematics|

* Cryptographic hash function
* Block cipher
* Stream cipher
* Symmetric-key algorithm
* Authenticated encryption
* Public-key cryptography
* Quantum key distribution
* Quantum cryptography
* Post-quantum cryptography
* Message authentication code
* Random numbers
* Steganography

* Category

*[v]: View this template
*[t]: Discuss this template
*[e]: Edit this template