\documentclass[a4paper]{llncs}

\usepackage{amsmath}
\usepackage{amssymb}

\newcommand{\GF}{\mathrm{GF}}
\newcommand{\vdm}{\mathrm{vdm}}
\newcommand{\cir}{\mathrm{cir}}
\newcommand{\matrices}[2]{\mathcal{M}_{#1 \times #2}[\GF(2^8)]}
\newcommand{\compository}{\mathop{\bigcirc}\displaylimits}
\newcommand{\gf}[1]{\texttt{#1}_x}
\newcommand{\B}{\mathcal{B}}
\newcommand{\w}{\mathrm{w_h}}
\newcommand{\Whirlpool}{\textsc{\mbox{Whirlpool}}}
\newcommand{\Square}{\textsc{\mbox{Square}}}
\newcommand{\Rijndael}{\textsc{\mbox{Rijndael}}}

\sloppy

\begin{document}

\pagestyle{plain}

\title{The {W\normalsize HIRLPOOL} Hashing Function}

\author{Paulo S.L.M. Barreto\inst{1}\thanks{Co-sponsored by the
Laborat\'{o}rio de Arquitetura e Redes de Computadores (LARC) do
Departamento de Engenharia de Computa\c{c}\~{a}o e Sistemas Digitais da
Escola Polit\'{e}cnica da Universidade de S\~{a}o Paulo (Brazil)}
\and Vincent Rijmen\inst{2}\thanks{F.W.O.
Postdoctoral Researcher, sponsored by the Fund for Scientific
Research -- Flanders (Belgium)}}

\institute{Scopus Tecnologia S.~A. \\
Av. Mutinga, 4105 - Pirituba\\
BR--05110--000 S\~{a}o Paulo (SP), Brazil\\
{\tt pbarreto@scopus.com.br} \and
Katholieke Universiteit Leuven, Dept. ESAT,\\
Kasteelpark Arenberg 10,\\
B--3001 Heverlee, Belgium \\
{\tt vincent.rijmen@esat.kuleuven.ac.be} }

\maketitle

\begin{abstract}
We present {\Whirlpool}, a new 512-bit hashing function operating on
messages less than $2^{256}$ bits in length. The function structure is
designed according to the Wide Trail strategy and permits a wide variety
of implementation tradeoffs.
\end{abstract}

\section{Introduction}

In this document we describe {\Whirlpool}, a new one-way, collision
resistant 512-bit hashing function operating on messages less than
$2^{256}$ bits in length. {\Whirlpool} has been submitted as a candidate
cryptographic primitive for the NESSIE project~\cite{nessie}.

{\Whirlpool} consists of the iterated application of a compression
function, based on an underlying dedicated 512-bit block cipher that
uses a 512-bit key. Both the round function and the key schedule are
designed according to the Wide Trail strategy~\cite{joan}.

{\Whirlpool} implementations on 8-bit and 64-bit processors benefit
especially from the function structure, which nevertheless is not
oriented towards any particular platform. As originally submitted for
the NESSIE evaluation effort, {\Whirlpool} employed a randomly generated
substitution box (S-box) whose lack of internal structure tended to make
efficient hardware implementation a challenging and tricky process. In
contrast to that version, though, the present document describes an
S-box that is much more amenable to hardware implementation, while not
adversely affecting any of the software implementation techniques
suggested herein. We propose renaming the original algorithm
{\Whirlpool-0} and using the term {\Whirlpool} for the final, modified
version that uses the improved S-box design.

This document is organised as follows. The mathematical preliminaries
and notation employed are described in section~\ref{preliminaries}. A
mathematical description of the {\Whirlpool} primitive is given in
section~\ref{description}. A statement of the claimed security
properties and expected security level is made in
section~\ref{sec-goals}. An analysis of the primitive with respect to
standard cryptanalytic attacks is provided in section~\ref{analysis} (a
statement that there are no hidden weaknesses inserted by the designers
is explicitly made in section~\ref{no-hidden-weakness}).
Section~\ref{rationale} contains the design rationale explaining design
choices. Implementation guidelines to avoid implementation weaknesses
are given in section~\ref{implementation}. Estimates of the
computational efficiency in software are provided in
section~\ref{efficiency}. The overall strengths and advantages of
the primitive are listed in section~\ref{advantages}.

\section{Mathematical preliminaries and notation}\label{preliminaries}

We now summarise the mathematical background and notation that
will be used throughout this paper.

\subsection{Finite fields}

We will represent the field $\GF(2^4)$ as $\GF(2)[x]/p_4(x)$ where
$p_4(x) = x^4 + x + 1$, and the field $\GF(2^8)$ as $\GF(2)[x]/p_8(x)$
where $p_8(x) = x^8 + x^4 + x^3 + x^2 + 1$. Polynomials $p_4(x)$ and
$p_8(x)$ are the first primitive polynomials of degrees 4 and 8 listed
in~\cite{lidl-niederreiter}, and were chosen so that $g(x) = x$ is a
generator of $\GF(2^4) \setminus \{0\}$ and $\GF(2^8) \setminus \{0\}$,
respectively.

A polynomial $u = \sum_{i=0}^{m-1}{u_i \cdot x^i} \in \GF(2)[x]$, where
$u_i \in \GF(2)$ for all $i = 0, \dots, m-1$, will be denoted by the
numerical value $\sum_{i=0}^{m-1}{u_i \cdot 2^i}$, and written in
hexadecimal notation. For instance, we write $\gf{13}$ to denote $p_4(x)$.

\subsection{Matrix classes}

$\matrices{m}{n}$ denotes the set of $m \times n$ matrices over
$\GF(2^8)$.

$\cir(a_0, a_1, \dots, a_{m-1})$ stands for the $m \times m$
circulant matrix whose first row consists of elements $a_0, a_1,
\dots, a_{m-1}$, i.e.
\[
\cir(a_0, a_1, \dots, a_{m-1}) \equiv %
\left[\begin{array}{cccc}
a_0 & a_1 & \dots & a_{m-1} \\
a_{m-1} & a_0 & \dots & a_{m-2} \\
\vdots & \vdots & \ddots & \vdots \\
a_1 & a_2 & \dots & a_0
\end{array} \right],
\]
or simply $\cir(a_0, a_1, \dots, a_{m-1}) = c \Leftrightarrow
c_{ij} = a_{(j - i) \bmod m}, \; 0 \leqslant i, j
\leqslant m - 1$.

\subsection{MDS codes}

The Hamming distance between two vectors $u$ and $v$ from the
$n$-dimensional vector space $\GF(2^p)^n$ is the number of coordinates
where $u$ and $v$ differ.

The Hamming weight $\w(a)$ of an element $a \in \GF(2^p)^n$ is the
Hamming distance between $a$ and the null vector of $\GF(2^p)^n$, i.e.
the number of nonzero components of $a$.

A \emph{linear $[n, k, d]$ code} over $\GF(2^p)$ is a $k$-dimensional
subspace of the vector space $(\GF(2^p))^n$, where the Hamming distance
between any two distinct subspace vectors is at least $d$ (and $d$ is
the largest number with this property).

A \emph{generator matrix $G$} for a linear $[n, k, d]$ code
$\mathcal{C}$ is a $k \times n$ matrix whose rows form a basis for
$\mathcal{C}$. A generator matrix is in \emph{echelon} or
\emph{standard} form if it has the form $G = [I_{k \times k} \, A_{k
\times (n-k)}]$, where $I_{k \times k}$ is the identity matrix of order
$k$. We write simply $G = [I \, A]$ omitting the indices wherever the
matrix dimensions are irrelevant for the discussion, or clear from the
context.

Linear $[n, k, d]$ codes obey the {\em Singleton bound}: $d \leqslant n
- k + 1$. A code that meets the bound, i.e. $d = n - k + 1$, is called a
\emph{maximal distance separable} (MDS) code. A linear $[n, k, d]$ code
$\mathcal{C}$ with generator matrix $G = [I_{k \times k} \, A_{k \times
(n-k)}]$ is MDS if, and only if, every square submatrix formed from rows
and columns of $A$ is nonsingular (cf.~\cite[chapter~11, \S\,4,
theorem~8]{macwilliams-sloane}).

\subsection{Cryptographic properties}

A product of $m$ distinct Boolean variables is called an $m$-th order
product of the variables. Every Boolean function $f: \GF(2)^n
\rightarrow \GF(2)$ can be written as a sum over $\GF(2)$ of distinct
$m$-order products of its arguments, $0 \leqslant m \leqslant n$; this
is called the algebraic normal form of $f$.

The \emph{nonlinear order} of $f$, denoted $\nu(f)$, is the maximum
order of the terms appearing in its algebraic normal form. A
\emph{linear} Boolean function is a Boolean function of nonlinear order
1, i.e. its algebraic normal form only involves isolated arguments.
Given $\alpha \in \GF(2)^n$, we denote by $l_{\alpha}: \GF(2)^n
\rightarrow GF(2)$ the linear Boolean function consisting of the sum of
the argument bits selected by the bits of $\alpha$: \[
l_{\alpha}(x) \equiv \bigoplus_{i=0}^{n-1} \alpha_i \cdot x_i.
\]

A mapping $S: \GF(2^n) \rightarrow \GF(2^n), x \mapsto S[x]$, is
called a \emph{substitution box}, or S-box for short. An S-box
can also be viewed as a mapping $S: \GF(2)^n \rightarrow
\GF(2)^n$ and therefore described in terms of its component
Boolean functions $s_i: \GF(2)^n \rightarrow \GF(2), 0 \leqslant i
\leqslant n-1$, i.e. $S[x] = (s_0(x), \dots, s_{n-1}(x))$.

The \emph{nonlinear order} of an S-box $S$, denoted $\nu_S$, is
the minimum nonlinear order over all linear combinations of the
components of $S$:
\[
\nu_S \equiv \min_{\alpha \in \GF(2)^n}\{\nu(l_{\alpha} \circ S)\}.
\]

The \emph{$\delta$-parameter} of an S-box $S$ is defined as
\[
\delta_S \equiv 2^{-n} \cdot \max_{a \neq 0, \, b}{\#\{c \in \GF(2^n)
| S[c \oplus a] \oplus S[c] = b\}}.
\]
The value $2^n \cdot \delta$ is called the \emph{differential
uniformity} of $S$.

The \emph{correlation} $c(f, g)$ between two Boolean functions $f$
and $g$ is defined as:
\[
c(f,g) \equiv 2^{1-n} \cdot \#\{x | f(x) = g(x)\} - 1.
\]

The extreme value (i.e. either the minimum or the maximum, whichever is
larger in absolute value) of the correlation between linear functions of
input bits and linear functions of output bits of $S$ is called the
\emph{bias} of $S$.

The \emph{$\lambda$-parameter} of an S-box $S$ is defined as the
absolute value of the bias:
\[
\lambda_S \equiv \max_{(i,j) \neq (0,0)} |c(l_i, l_j \circ S)|.
\]

The \emph{branch number $\B$} of a linear mapping $\theta:
\GF(2^p)^k \rightarrow \GF(2^p)^m$ is defined as
\[
\B(\theta) \equiv \min_{a \neq 0}\{\w(a) + \w(\theta(a))\}.
\]

Given a $[k + m, k, d]$ linear code over $\GF(2^p)$ with generator
matrix $G = [I_{k \times k} \, M_{k \times m}]$, the linear
mapping $\theta: \GF(2^p)^k \rightarrow \GF(2^p)^m$ defined by
$\theta(a) = a \cdot M$ has branch number $\B(\theta) = d$; if
the code is MDS, such a mapping is called an \emph{optimal
diffusion mapping}~\cite{vincent}.

\subsection{Miscellaneous notation}

Given a sequence of functions $f_m, f_{m+1}, \dots, f_{n-1}, f_n,
\, m \leqslant n$, we use the notation
$\compository_{r=m}^n{\,f_r} \equiv f_m \circ f_{m+1} \circ \dots
\circ f_{n-1} \circ f_n$, and $\compository^{r=n}_m{\,f_r} \equiv
f_n \circ f_{n-1} \circ \dots \circ f_{m+1} \circ f_m$; if $m >
n$, both expressions stand for the identity mapping.

\section{Description of the {W\normalsize HIRLPOOL}
primitive}\label{description}

The {\Whirlpool} primitive is a Merkle hashing function
(cf.~\cite[algorithm 9.25]{hac}) based on a dedicated block cipher, $W$,
which operates on a 512-bit \emph{hash state} using a chained \emph{key
state}, both derived from the input data. In the following we will
individually define the component mappings and constants that build up
{\Whirlpool}, then specify the complete hashing function in terms of
these components.

\subsection{Input and output}

The hash state is internally viewed as a matrix in
$\matrices{8}{8}$. Therefore, 512-bit data blocks (externally
represented as byte arrays by sequentially grouping the bits in
8-bit chunks) must be mapped to and from this matrix format. This
is done by function $\mu: \GF(2^8)^{64} \rightarrow
\matrices{8}{8}$ and its inverse:
\[
\mu(a) = b \,\Leftrightarrow\, b_{ij} = a_{8i
+ j}, \; 0 \leqslant i, j \leqslant 7.
\]

\subsection{The nonlinear layer $\gamma$}

Function $\gamma: \matrices{8}{8} \rightarrow \matrices{8}{8}$
consists of the parallel application of a nonlinear substitution
box $S: \GF(2^8) \rightarrow \GF(2^8), \, x \mapsto S[x]$ to all
bytes of the argument individually:
\[
\gamma(a) = b \Leftrightarrow b_{ij} = S[a_{ij}], \; 0 \leqslant
i, j \leqslant 7.
\]
The substitution box is discussed in detail in section~\ref{sbox-crit}.

\subsection{The cyclical permutation $\pi$}

The permutation $\pi: \matrices{8}{8} \rightarrow
\matrices{8}{8}$ cyclically shifts each column of its argument
independently, so that column $j$ is shifted downwards by $j$
positions:
\[
\pi(a) = b \Leftrightarrow b_{ij} = a_{(i-j) \bmod 8,j}, \; 0
\leqslant i, j \leqslant 7.
\]
The purpose of $\pi$ is to disperse the bytes of each row among
all rows.

\subsection{The linear diffusion layer $\theta$}

The diffusion layer $\theta: \matrices{8}{8} \rightarrow
\matrices{8}{8}$ is a linear mapping based on the $[16, 8, 9]$ MDS
code with generator matrix $G_C = [I \, C]$ where $C =
\cir(\gf{01}, \gf{01}, \gf{03}, \gf{01}, \gf{05}, \gf{08},
\gf{09}, \gf{05})$, i.e.
\[
C = \left[\begin{array}{cccccccc} %
\gf{01} & \gf{01} & \gf{03} & \gf{01} & \gf{05} & \gf{08} & \gf{09} & \gf{05}\\ %
\gf{05} & \gf{01} & \gf{01} & \gf{03} & \gf{01} & \gf{05} & \gf{08} & \gf{09}\\ %
\gf{09} & \gf{05} & \gf{01} & \gf{01} & \gf{03} & \gf{01} & \gf{05} & \gf{08}\\ %
\gf{08} & \gf{09} & \gf{05} & \gf{01} & \gf{01} & \gf{03} & \gf{01} & \gf{05}\\ %
\gf{05} & \gf{08} & \gf{09} & \gf{05} & \gf{01} & \gf{01} & \gf{03} & \gf{01}\\ %
\gf{01} & \gf{05} & \gf{08} & \gf{09} & \gf{05} & \gf{01} & \gf{01} & \gf{03}\\ %
\gf{03} & \gf{01} & \gf{05} & \gf{08} & \gf{09} & \gf{05} & \gf{01} & \gf{01}\\ %
\gf{01} & \gf{03} & \gf{01} & \gf{05} & \gf{08} & \gf{09} & \gf{05} & \gf{01}   %
\end{array}\right],
\]
so that $\theta(a) = b \Leftrightarrow b = a \cdot C$. The effect of
$\theta$ is to mix the bytes in each state row.

\subsection{The key addition $\sigma[k]$}

The affine key addition $\sigma[k]: \matrices{8}{8} \rightarrow
\matrices{8}{8}$ consists of the bitwise addition (exor) of a key
matrix $k \in \matrices{8}{8}$:
\[
\sigma[k](a) = b \Leftrightarrow b_{ij} = a_{ij} \oplus k_{ij}, \;
0 \leqslant i, j \leqslant 7.
\]
This mapping is also used to introduce round constants in the key
schedule.

\subsection{The round constants $c^r$}\label{round-const}

The round constant for the $r$-th round, $r > 0$, is a matrix
$c^r \in \matrices{8}{8}$, defined as:
\[
\begin{array}{lcll}
c_{0j}^r & \equiv & S[8(r - 1) + j], & 0 \leqslant j \leqslant 7,\\
c_{ij}^r & \equiv & 0, & 1 \leqslant i \leqslant 7, 0 \leqslant j \leqslant 7.
\end{array}
\]

\subsection{The round function $\rho[k]$}

The $r$-th round function is the composite mapping $\rho[k]:
\matrices{8}{8} \rightarrow \matrices{8}{8}$, parameterised by the key
matrix $k \in \matrices{8}{8}$ and given by:
\[
\rho[k] \equiv \sigma[k] \circ \theta \circ \pi \circ \gamma.
\]

\subsection{The key schedule}

The key schedule expands the 512-bit cipher key $K \in
\matrices{8}{8}$ onto a sequence of round keys $K^0, \dots, K^R$:
\begin{eqnarray*}
K^0 & = & K,\\
K^r & = & \rho[c^r](K^{r-1}), \; r > 0,
\end{eqnarray*}

\subsection{The internal block cipher $W$}

The dedicated 512-bit block cipher $W[K]: \matrices{8}{8}
\rightarrow \matrices{8}{8}$, parameterised by the 512-bit cipher
key $K$, is defined as
\[
W[K] = \left(\compository^{r=R}_1{\rho[K^r]}\right) \circ
\sigma[K^0],
\]
where the round keys $K^0, \dots, K^R$ are derived from $K$ by the
key schedule. The default number of rounds is $R = 10$.

\subsection{Padding and MD-strengthening}

Before being subjected to the hashing operation, a message $M$ of
bit length $L < 2^{256}$ is padded with a 1-bit, then with as few
0-bits as necessary to obtain a bit string whose length is an odd
multiple of 256, and finally with the 256-bit right-justified
binary representation of $L$, resulting in the padded message
$m$, partitioned in $t$ blocks $m_1, \dots, m_t$. These blocks
are viewed as byte arrays by sequentially grouping the bits in
8-bit chunks.

\subsection{The compression function}

{\Whirlpool} iterates the Miyaguchi-Preneel hashing scheme
(cf.~\cite[algorithm~9.43]{hac}) over the $t$ padded message blocks
$m_i$, $1 \leqslant i \leqslant t$, using the dedicated 512-bit block
cipher $W$:
\begin{eqnarray*}
\eta_i & = & \mu(m_i),\\
H_0 & = & \mu(IV),\\
H_i & = & W[H_{i-1}](\eta_i) \oplus H_{i-1} \oplus \eta_i, \; 1
\leqslant i \leqslant t,
\end{eqnarray*}
where $IV$ (the \emph{initialisation vector}) is a string of 512
0-bits.

\subsection{Message digest computation}
The {\Whirlpool} message digest for message message $M$ is defined as
the output $H_t$ of the compression function, mapped back to a bit
string:
\[
{\Whirlpool}(M) \equiv \mu^{-1}(H_t).
\]

\section{Security goals}\label{sec-goals}

In this section, we present the goals we have set for the security of
{\Whirlpool}. A cryptanalytic attack will be considered successful by
the designers if it demonstrates that a security goal described herein
does not hold.

\subsection{Expected strength}

Assume we take as hash result the value of any $n$-bit substring of the
full {\Whirlpool} output. Then:

\begin{itemize}
\item The expected workload of generating a collision is of the
order of $2^{n/2}$ executions of {\Whirlpool}.
\item Given an $n$-bit value, the expected workload of finding a
message that hashes to that value is of the order of $2^n$
executions of {\Whirlpool}.
\item Given a message and its $n$-bit hash result, the expected
workload of finding a second message that hashes to the same value
is of the order of $2^n$ executions of {\Whirlpool}.
\end{itemize}
Moreover, it is infeasible to detect systematic correlations between any
linear combination of input bits and any linear combination of bits of
the hash result. It is also infeasible to predict what bits of the hash
result will change value when certain input bits are flipped, i.e.
{\Whirlpool} is resistant against differential attacks.

These claims result from the considerable safety margin taken with
respect to all known attacks. We do however realise that it is
impossible to make non-speculative statements on things unknown.

\section{Analysis}\label{analysis}

In contrast to the extension of public research on block cipher
cryptanalysis, hashing function constructions based on block ciphers
have received surprisingly scarce attention. We summarise here the
available research results applicable to {\Whirlpool} components.

\subsection{Security of the compression function}

The Miyaguchi-Preneel scheme is one of the few still unbroken methods to
construct a hashing function from an underlying block
cipher~\cite{preneel}. Its security properties are discussed
in~\cite[section~9.4.1]{hac}; in particular, it is ``provably secure''
if certain ideal properties hold for the underlying block cipher.

\subsection{Differential cryptanalysis}

The application of differential cryptanalysis techniques to hash
functions based on block ciphers has been studied in
\cite{P93b,vincent-hash}. Although there are some inportant differences
between differential attacks on block ciphers and differential attacks
on hash functions, basically the same techniques and reasonings apply.
Both attacks require that a differential characteristic is found, that
has a sufficiently large probability.

The branch number of the $\theta$ transform is $\B = 9$. Due to the
{\Square} pattern propagation theorem
(cf.~\cite[proposition~7.9]{vincent}), for any two different input
values of $W$, it holds that the number of S-boxes with a different
input value in four consecutive rounds is at least  $\B^2 = 81$. As a
consequence, no differential characteristic over four rounds of $W$ has
probability larger than $\delta^{\B^2} = (2^{-5})^{81} = 2^{-405}$. This
makes a classical differential attack very unlikely to succeed for the
full hash function.

\subsection{Attacks against the internal block cipher $W$}

For completeness, we list the best attacks known against the internal
block cipher $W$ with reduced number of rounds. We point out, however,
that these attacks are not directly applicable to {\Whirlpool}.

The best key recovery attack known against $W$ reduced to 7 rounds is an
extension of the attack by Gilbert and Minier \cite{gilbert-minier}. The
attack requirements are $2^{64}$ guesses for one column of the first
round key $\times$ $2^{32}$ $c$-sets $\times$ $16$ values to be
encrypted per entry $\times$ 2 tables $\times$ $2^{144}$ entries/table.
This sums up to $2^{245}$ steps.

It is possible to mount an attack against 7 rounds of $W$ using ideas
described in~\cite{partial-sum}, but the complexity is extremely high:
$2^{512}$ S-box lookups, $2^{128}$ bits of storage and $O(2^{512})$
plaintexts. This is essentially the complexity of finding a preimage or
second preimage by brute force (and certainly much larger than the
complexity of finding a collision by means of the birthday paradox).

No attack is known against more rounds of $W$ faster than
exhaustive search.

\subsection{Encryption-decryption cascade:} Since {\Whirlpool} does not
use the decryption form of the internal cipher $W$,
encryption-decryption cascades as described in~\cite[pp.~39]{hac} would
imply the existence of semi-weak keys, such that encryption with one key
corresponds to decryption with another key. We don't believe that
semi-weak keys exist for {\Whirlpool}.

\subsection{Designers' statement on the absence of hidden
weaknesses}\label{no-hidden-weakness}

In spite of any analysis, doubts might remain regarding the presence of
trapdoors deliberately introduced in the algorithm. That is why the
NESSIE effort asks for the designers' declaration on the contrary.

Therefore we, the designers of {\Whirlpool}, do hereby declare that
there are no hidden weaknesses inserted by us in the {\Whirlpool}
primitive.

\section{Design rationale}\label{rationale}

\subsection{Hashing mode}

Why Miyaguchi-Preneel instead of, say, Matyas-Meyer-Oseas (MMO)? Notice
that the key schedule resembles encryption of the cipher key under a
pseudo-key defined by the round constants, so that the core of the
hashing process could be formally viewed as two interacting encryption
lines. Consider the encryption $W[H_{i-1}](\eta_i)$. We could write the
last round key as $K^R = W'[c](H_{i-1})$; this quantity is exored onto
the cipher state as the last encryption step. Now take a look at the MMO
recursion: $H_i = W[H_{i-1}](\eta_i) \oplus \eta_i$. Formally applying
this construction to the ``key encryption line'' we get ${K'}^R =
W'[c](H_{i-1}) \oplus H_{i-1}$. Using this value as the effective last
round key formally creates two interacting MMO lines (as compared to the
interacting encryption lines), and results in the Miyaguchi-Preneel
scheme, which therefore shows up as the natural choice for the
compression function.

\subsection{Choice of the substitution box}\label{sbox-crit}

The originally submitted form of {\Whirlpool} used a pseudo-randomly
generated S-box, chosen to satisfy the following conditions:
\begin{itemize}
\item The $\delta$-parameter must not exceed $8 \times 2^{-8}$.
\item The $\lambda$-parameter must not exceed $16 \times 2^{-6}$.
\item The nonlinear order $\nu$ must be maximum, namely, 7.
\end{itemize}
The bounds on $\delta$ and $\lambda$ correspond to twice the minimum
achievable values for these quantities. An additional condition, that
the S-box has no fixed point, was imposed in an attempt to speed up the
search. This condition was inspired by the empirical study reported
in~\cite[section 2.3]{youssef-tavares-heys}, where the strong
correlation found between the cryptographic properties and the number of
fixed points of a substitution box suggests minimising the number of
such points. The polynomial and rational representations of $S$ over
$\GF(2^8)$ are checked as well, to avoid any obvious algebraic weakness
(which could lead e.g. to interpolation attacks~\cite{interpolation}).

However, the extreme lack of structure in such an S-box hinders
efficient hardware implementation. Moreover, a flaw that went unnoticed
in the random search program caused the value of $\lambda$ for the
original S-box to be incorrectly reported as $15 \times 2^{-6}$ instead
of the actual value $16 \times 2^{-6}$ (corresponding to a negative
bias)\footnote{We thank the NESSIE evaluation team for pointing out this
discrepancy~\cite{nessie-lambda}.}. Therefore, we now describe an
alternative S-box that, besides strictly satisfying the design
conditions, is amenable to much more efficient implementation in
hardware, while not affecting the software implementation techniques
presented here in any reasonable way.

The new S-box is illustrated in figure~\ref{fig:whirlpool}. This
structure has its origin in a simple three-layer construction consisting
of two nonlinear layers (each containing two $4 \times 4$ S-boxes)
separated by a symmetric linear transform $M: \GF(2^4)^2 \leftarrow
\GF(2^4)^2$. The most general form such a transform can assume is given
by the matrix \[ M = \left[
\begin{array}{cc} a + 1 & a\\ a & a + 1
\end{array}
\right], \; a \in \GF(2^4),
\]
which reduces to the structure in figure~\ref{fig:whirlpool} by setting
$R(u) \equiv a \cdot u$.

\begin{figure}[htb]\centering
\setlength{\unitlength}{0.7mm}
\begin{picture}(95,110)
\thicklines %
\put( 0,90){\framebox(25,10){$E$}} %
\put(70,90){\framebox(25,10){$E^{-1}$}} %
\put(35,50){\framebox(25,10){$R$}} %
\put( 0,10){\framebox(25,10){$E$}} %
\put(70,10){\framebox(25,10){$E^{-1}$}} %
\multiput( 0, 0)(0,100){2}{
   \multiput( 5,10)(5,0){4}{\vector(0,-1){10}}
   \multiput(75,10)(5,0){4}{\vector(0,-1){10}}
} %
\multiput(37.5,85)(5,-5){4}{\line(1,0){5}} %
\multiput(40,82.5)(5,-5){4}{\line(0,1){5}} %
\multiput(40,85)(5,-5){4}{\circle{5}} %
%
\multiput( 2.5,30)(5, 5){4}{\line(1,0){5}} %
\multiput( 5,27.5)(5, 5){4}{\line(0,1){5}} %
\multiput( 5,30)(5, 5){4}{\circle{5}} %
%
\multiput(72.5,45)(5,-5){4}{\line(1,0){5}} %
\multiput(75,42.5)(5,-5){4}{\line(0,1){5}} %
\multiput(75,45)(5,-5){4}{\circle{5}} %
%
\multiput( 0, 0)(5,-5){4}{
   \put( 5,85){\vector( 1,0){32.5}}
   \put( 5,85){\circle*{1.5}}
   \put(75,85){\vector(-1,0){32.5}}
   \put(75,85){\circle*{1.5}}
} %
\put( 5,90){\vector(0,-1){57.5}} %
\put(10,90){\vector(0,-1){52.5}} %
\put(15,90){\vector(0,-1){47.5}} %
\put(20,90){\vector(0,-1){42.5}} %
\put( 5,27.5){\vector(0,-1){ 7.5}} %
\put(10,32.5){\vector(0,-1){12.5}} %
\put(15,37.5){\vector(0,-1){17.5}} %
\put(20,42.5){\vector(0,-1){22.5}} %
%
\put(75,90){\vector(0,-1){42.5}} %
\put(80,90){\vector(0,-1){47.5}} %
\put(85,90){\vector(0,-1){52.5}} %
\put(90,90){\vector(0,-1){57.5}} %
\put(75,42.5){\vector(0,-1){22.5}} %
\put(80,37.5){\vector(0,-1){17.5}} %
\put(85,32.5){\vector(0,-1){12.5}} %
\put(90,27.5){\vector(0,-1){ 7.5}} %
%
\put(40,82.5){\vector(0,-1){22.5}} %
\put(45,77.5){\vector(0,-1){17.5}} %
\put(50,72.5){\vector(0,-1){12.5}} %
\put(55,67.5){\vector(0,-1){ 7.5}} %
%
\multiput( 0, 0)(5,-5){4}{
   \put(40,45){\vector( 1,0){32.5}}
   \put(40,45){\circle*{1.5}}
} %
%
\put(40,45){\vector(-1,0){17.5}} %
\put(45,40){\vector(-1,0){27.5}} %
\put(50,35){\vector(-1,0){37.5}} %
\put(55,30){\vector(-1,0){47.5}} %
%
\put(40,50){\line(0,-1){ 5}} %
\put(45,50){\line(0,-1){10}} %
\put(50,50){\line(0,-1){15}} %
\put(55,50){\line(0,-1){20}} %
\end{picture}
\caption{\label{fig:whirlpool}Structure of the {\Whirlpool} S-box. $E$
corresponds to the mapping $E: \GF(2^4) \rightarrow \GF(2^4): E(u) =
\gf{B}^u$ if $u \neq \gf{F}$, and $E(\gf{F}) = 0$. $R$ is
pseudo-randomly generated in a verifiable way. Both have optimal values
of $\delta$, $\lambda$, and $\nu$.}
\end{figure}

The $E$ table (as well as its inverse $E^{-1}$) is not generated at
random; rather, it is derived from a simple exponential mapping with
optimal $\delta$, $\lambda$, and $\nu$, namely:
\[
E: \GF(2^4) \rightarrow \GF(2^4): E(u) = \left\{
\begin{array}{ll}
\gf{B}^u & \textrm{if}\; u \neq \gf{F},\\
\gf{0} & \textrm{otherwise},
\end{array}
\right.
\]
where the occurrence of $u = u_3 x^3 + u_2 x^2 + u_1 x + u_0$ as an
exponent in $\gf{B}^u$ is taken to be its numerical value
$\sum_{i=0}^3{u_i \cdot 2^i}$. The basis $\gf{B}$ was chosen so that
$E$ has neither fixed points (i.e. values $u$ such that $E(u) = u$) nor
points $u$ such that $E(E(u)) = u$. Notice that $E^{-1}$ satisfies the
same properties.

The $R$ table is a pseudo-randomly generated permutation with optimal
$\delta$, $\lambda$, and $\nu$, chosen so that the S-box built from $E$,
$E^{-1}$ and $R$ satisfies the design criteria listed at the beginning
of this section.

Table~\ref{tab:E-table} lists the $E$ permutation, and
table~\ref{tab:R-table} shows the $R$ permutation found by the searching
algorithm.

The random search we carried out was able to find an S-box with $\lambda
= 14 \times 2^{-6}$, slightly better than the design bound. A
description of the searching algorithm and a listing of the resulting
S-box are given in the appendix.

\begin{table}\centering
\caption{The $E$ mini-box}\label{tab:E-table}
\begin{tabular}{|l|c|c|c|c|c|c|c|c|c|c|c|c|c|c|c|c|}\hline
$u$    & $\gf{0}$ & $\gf{1}$ & $\gf{2}$ & $\gf{3}$ & $\gf{4}$ & $\gf{5}$ & $\gf{6}$ & $\gf{7}$ & $\gf{8}$ & $\gf{9}$ & $\gf{A}$ & $\gf{B}$ & $\gf{C}$ & $\gf{D}$ & $\gf{E}$ & $\gf{F}$\\\hline%
$E[u]$ & $\gf{1}$ & $\gf{B}$ & $\gf{9}$ & $\gf{C}$ & $\gf{D}$ & $\gf{6}$ & $\gf{F}$ & $\gf{3}$ & $\gf{E}$ & $\gf{8}$ & $\gf{7}$ & $\gf{4}$ & $\gf{A}$ & $\gf{2}$ & $\gf{5}$ & $\gf{0}$\\\hline%
\end{tabular}
\end{table}

\begin{table}\centering
\caption{The $R$ mini-box}\label{tab:R-table}
\begin{tabular}{|l|c|c|c|c|c|c|c|c|c|c|c|c|c|c|c|c|}\hline
$u$    & $\gf{0}$ & $\gf{1}$ & $\gf{2}$ & $\gf{3}$ & $\gf{4}$ & $\gf{5}$ & $\gf{6}$ & $\gf{7}$ & $\gf{8}$ & $\gf{9}$ & $\gf{A}$ & $\gf{B}$ & $\gf{C}$ & $\gf{D}$ & $\gf{E}$ & $\gf{F}$\\\hline%
$R[u]$ & $\gf{7}$ & $\gf{C}$ & $\gf{B}$ & $\gf{D}$ & $\gf{E}$ & $\gf{4}$ & $\gf{9}$ & $\gf{F}$ & $\gf{6}$ & $\gf{3}$ & $\gf{8}$ & $\gf{A}$ & $\gf{2}$ & $\gf{5}$ & $\gf{1}$ & $\gf{0}$\\\hline%
\end{tabular}
\end{table}

\subsection{Choice of the diffusion layer}

The adopted circulant matrix $C$ has as many 1-elements as possible
(namely, 3 per row) for an $8 \times 8$ circulant MDS matrix;
furthermore the Hamming weight of any element is at most 2. This is
advantageous especially in hardware and smart card implementations.

\subsection{The last round}

One difference between the {\Whirlpool} structure and the structure of
{\Square} and {\Rijndael} is the fact that, in the former, the operation
$\theta$ is present in all rounds, while in the latter it is not present
in the first or in the last round. Firstly, we will explain why one
application of the operation $\theta$ can be left out without changing
the security level of the cipher. Subsequently, we list some motivations
to leave out one application of the operation $\theta$, followed by the
motivation why it was kept in for {\Whirlpool}.

\subsubsection{Why it is possible to leave $\theta$ out:}

Consider a {\Square}-like cipher with two rounds, and an extra key
addition:
\begin{equation} \label{eq1}
E = \sigma[K^2] \circ \tau \circ \gamma \circ  \theta \circ
\sigma[K^1] \circ \tau \circ \gamma \circ \theta \circ
\sigma[K^0].
\end{equation}
As explained in \cite{square}, the operations $\theta$ and
$\sigma[K]$ can be exchanged, provided that the key $K$ is
replaced by an equivalent key $K' = \theta(K)$. Consequently, we
can write (\ref{eq1}) as:
\begin{equation} \label{eq2}
E = \sigma[K^2] \circ \tau \circ \gamma \circ  \theta \circ
\sigma[K^1] \circ  \tau \circ \gamma \circ \sigma[\theta(K^0)]
\circ \theta.
\end{equation}
In (\ref{eq2}), it is obvious that the first application of
$\theta$ does not contribute to the security of the cipher,
because it can always be undone by an attacker, without knowing
the key. Therefore, we can leave it out of the definition of our
cipher (\ref{eq1}). The new definition becomes:
\begin{equation} \label{eq3}
E' = \sigma[K^2] \circ \tau \circ \gamma \circ  \theta \circ
\sigma[K^1] \circ  \tau \circ \gamma \circ \sigma[K^0].
\end{equation}

Observe that in this analysis we did not make any assumption
about the attack that an attacker is trying to mount. We proved
generally that the security of $E$ and $E'$ are equivalent.

\subsubsection{Motivation to leave $\theta$ out:}

One motivation to leave out one application of $\theta$, is that it does
not contribute to the cipher's security. Furthermore, implementations on
small processors that execute all transformations explicitly will
probably experience increased performance. Thirdly, (\ref{eq3}) has the
advantage that encryption and decryption are more similar to one
another\footnote{However, in {\Whirlpool} the internal cipher $W$
operates only in encryption mode, hence the third motivation to keep
$\theta$ is not important here.} than for (\ref{eq1}).

\subsubsection{Motivation to leave $\theta$ in:}

The best motivation to keep all rounds identical to one another,
is the performance on processors with a medium-sized fast cache
memory. If not all rounds are identical, then the number of tables
that have to be stored in memory increases. For fast
implementations of {\Square}, it turns out that the
tables for the complete rounds can be stored in the cache, but
there is no place left for the tables of the incomplete round.
The net result is that the round without $\theta$ takes longer
to execute.

\section{Implementation}\label{implementation}

{\Whirlpool} can be implemented very efficiently. On different
platforms, different optimisations and tradeoffs are possible. We make
here a few suggestions.

\subsection{64-bit processors} \label{verylarge-processors}

We suggest a lookup-table approach to implement $\rho$. Let $C_k$ be the
$k$-th row of the circulant matrix $C$; using eight tables $T_k[x] \equiv S[x]
\cdot C_k, \; 0 \leqslant k \leqslant 7$, i.e.:
\[
\begin{array}{lcl}
T_0[x] & = & S[x] \cdot [\begin{array}{cccccccc} \gf{01} & \gf{01} & \gf{03} & \gf{01} & \gf{05} & \gf{08} & \gf{09} & \gf{05} \end{array}], \\ %
T_1[x] & = & S[x] \cdot [\begin{array}{cccccccc} \gf{05} & \gf{01} & \gf{01} & \gf{03} & \gf{01} & \gf{05} & \gf{08} & \gf{09} \end{array}], \\ %
T_2[x] & = & S[x] \cdot [\begin{array}{cccccccc} \gf{09} & \gf{05} & \gf{01} & \gf{01} & \gf{03} & \gf{01} & \gf{05} & \gf{08} \end{array}], \\ %
T_3[x] & = & S[x] \cdot [\begin{array}{cccccccc} \gf{08} & \gf{09} & \gf{05} & \gf{01} & \gf{01} & \gf{03} & \gf{01} & \gf{05} \end{array}], \\ %
T_4[x] & = & S[x] \cdot [\begin{array}{cccccccc} \gf{05} & \gf{08} & \gf{09} & \gf{05} & \gf{01} & \gf{01} & \gf{03} & \gf{01} \end{array}], \\ %
T_5[x] & = & S[x] \cdot [\begin{array}{cccccccc} \gf{01} & \gf{05} & \gf{08} & \gf{09} & \gf{05} & \gf{01} & \gf{01} & \gf{03} \end{array}], \\ %
T_6[x] & = & S[x] \cdot [\begin{array}{cccccccc} \gf{03} & \gf{01} & \gf{05} & \gf{08} & \gf{09} & \gf{05} & \gf{01} & \gf{01} \end{array}], \\ %
T_7[x] & = & S[x] \cdot [\begin{array}{cccccccc} \gf{01} & \gf{03} & \gf{01} & \gf{05} & \gf{08} & \gf{09} & \gf{05} & \gf{01} \end{array}],    %
\end{array}
\]
then a row $b_i$ of $b = (\theta \circ \pi \circ \gamma)(a)$ can
be calculated with eight table lookups and seven exor operations
as:
\[
b_i = \bigoplus_{k=0}^7{T_k[a_{(i-k)\bmod 8, k}]};
\]
the key addition then completes the evaluation of $\rho$ with a single
additional exor. The $T$-tables require $2^8 \times 8$ bytes of storage each.
An implementation can use the fact that the corresponding entries of different
$T$-tables are cyclical permutations of one another and save some memory at
the expense of introducing extra permutations at runtime. Usually this
decreases the performance of the implementation.

\subsection{32-bit processors} \label{large-processors}

Any circulant matrix $C$ of order $2m$ shows the following
structure:
\[
C = \left[\begin{array}{cc}
U & V \\
V & U \\
\end{array}\right],
\]
where $U$ and $V$ are matrices of order $m$. A 32-bit
implementation may take advantage of this structure by
representing elements $c \in \GF(2^8)^8$ as pairs $c =
\left[\begin{array}{cc} \hat{c}_0 \, & \hat{c}_1
\end{array}\right]$ of elements $\hat{c}_i \in \GF(2^8)^4$:
\[
b = \theta (a) \Leftrightarrow
\left\{\begin{array}{ccc}%
\hat{b}_0 & = & \hat{a}_0 U \,\oplus\, \hat{a}_1 V,\\%
\hat{b}_1 & = & \hat{a}_0 V \,\oplus\, \hat{a}_1 U,  %
\end{array}\right.
\]
with twice the complexity derived for 64-bit processors regarding
the number of table lookups and exors, but using smaller tables
(each occupying $2^8 \times 4$ bytes).

\subsection{8-bit processors}\label{smart-cards}

On an 8-bit processor with a limited amount of RAM, e.g. a typical smart
card processor, the previous approach is not feasible. On these
processors the substitution is performed byte by byte, combined with the
$\sigma[k]$ transformation. For $\theta$, it is necessary to implement
the matrix multiplication. The following piece of pseudo-code calculates
one row of $b = \theta(a)$, using a table $X$ that implements
multiplication by the polynomial $g(x) = x$ in $\GF(2^8)$ (i.e. $X[u]
\equiv x \cdot u$) and five auxiliary variables $t_0$ to $t_3$ and $z$,
at the cost of 51 exors and 24 table lookups:

\begin{tabbing}for \= \kill
\> $t_0 \leftarrow a_{i0} \oplus a_{i1}$; $t_1 \leftarrow a_{i2} \oplus a_{i3}$; $t_2 \leftarrow a_{i4} \oplus a_{i5}$; $t_3 \leftarrow a_{i6} \oplus a_{i7}$;\\%
\> $z \leftarrow t_0 \oplus t_1 \oplus t_2 \oplus t_3$;\\%
\> $b_{i0} \leftarrow z \oplus a_{i3} \oplus X[a_{i6} \oplus X[a_{i1} \oplus a_{i4} \oplus X[t_1]]]$;\\%
\> $b_{i1} \leftarrow z \oplus a_{i4} \oplus X[a_{i7} \oplus X[a_{i2} \oplus a_{i5} \oplus X[a_{i3} \oplus a_{i4}]]]$;\\%
\> $b_{i2} \leftarrow z \oplus a_{i5} \oplus X[a_{i0} \oplus X[a_{i3} \oplus a_{i6} \oplus X[t_2]]]$;\\%
\> $b_{i3} \leftarrow z \oplus a_{i6} \oplus X[a_{i1} \oplus X[a_{i4} \oplus a_{i7} \oplus X[a_{i5} \oplus a_{i6}]]]$;\\%
\> $b_{i4} \leftarrow z \oplus a_{i7} \oplus X[a_{i2} \oplus X[a_{i5} \oplus a_{i0} \oplus X[t_3]]]$;\\%
\> $b_{i5} \leftarrow z \oplus a_{i0} \oplus X[a_{i3} \oplus X[a_{i6} \oplus a_{i1} \oplus X[a_{i7} \oplus a_{i0}]]]$;\\%
\> $b_{i6} \leftarrow z \oplus a_{i1} \oplus X[a_{i4} \oplus X[a_{i7} \oplus a_{i2} \oplus X[t_0]]]$;\\%
\> $b_{i7} \leftarrow z \oplus a_{i2} \oplus X[a_{i5} \oplus X[a_{i0} \oplus a_{i3} \oplus X[a_{i1} \oplus a_{i2}]]]$;%
\end{tabbing}

\subsection{Techniques to avoid software implementation weaknesses}

Hash functions do not use secret keys. In principle, they are not
vulnerable to the key recovery techniques described by Kocher \emph{et
al.}~\cite{timing,power}. However, hash functions are sometimes used as
building blocks for other cryptographic primitives, such as MACs, that
use secret keys. In that case, the necessary attention should be given
to the implementation of the round transformation as well as the key
scheduling of the primitive.

A first example is the \emph{timing attack}~\cite{timing} that can be
applicable if the execution time of the primitive depends on the value
of the key and the plaintext. This is typically caused by the presence
of conditional execution paths. For instance, multiplication by a
constant value over a finite field is sometimes implemented as a
multiplication followed by a reduction, the latter being implemented as
a conditional exor. This vulnerability is avoided by implementing the
multiplication by a constant by means of table lookups, as proposed in
sections~\ref{verylarge-processors}, \ref{large-processors},
and~\ref{smart-cards}.

A second class of attacks are the attacks based on the careful
observation of the power consumption pattern of an encryption
device~\cite{power}. Protection against this type of attack can only be
achieved by combined measures at the hardware and software level. We
leave the final word on this issue to the specialists, but we hope that
the simple structure and the limited number of operations in
{\Whirlpool} will make it easier to create an implementation that
resists this type of attacks.

\subsection{Hardware implementation}

We have currently no precise figures on the available performance and
required area or gate count of {\Whirlpool} in ASIC or FPGA, nor do we
have a description in VHDL. However, we expect that the results on
{\Rijndael}~\cite{hw1,hw2} will carry over to some extent\footnote{In
particular, the S-box structure can be implemented in about $1/5$ the
number of gates used by the implementation of the {\Rijndael} S-box
reported in~\cite{whiting-aesforum}, which takes about 500--600
gates~\cite{whiting-email}.}.

\section{Efficiency estimates}\label{efficiency}

Using the reference C implementation on a 550 MHz Pentium III platform,
we observe that {\Whirlpool} operates at about 172 cycles per hashed
byte. The compression function runs at about 137 cycles per hashed byte.

Many factors explain the poor observed performance. First, a
32-bit processor was used to test a native 64-bit implementation;
better results are expected by merely running the speed
measurement on an Alpha or Itanium processor. Second, it seems
that the pipe parallelism capabilities of the Pentium were not
fully used; this may reflect a non-optimising implementation of
64-bit arithmetic support by the C compiler, and might be
overcome by an assembler implementation. Third, the tables
employed in the reference implementation are quite large, and the
built-in processor cache might not be enough to hold them, the
data being hashed, and the hashing code at once, thus degrading
processing speed.

\section{Advantages}\label{advantages}

{\Whirlpool} is much more scalable than most modern hashing functions.
It is not specifically oriented toward platforms that may be obsolete by
the time the NESSIE project concludes its evaluation process. It is
rather efficient on many platforms, its structure favouring extensively
parallel execution of the component mappings. At the same time, it does
not require excessive storage space (either for code or for tables), and
can therefore be efficiently implemented in quite constrained
environments like smart cards, although it can benefit from larger cache
memory available on modern processors to achieve higher performance. It
does not use expensive or unusual instructions that must be built in the
processor. The mathematical simplicity of the primitive resulting from
the design strategy tends to make analysis easier. And finally, it has a
very long hash length; this not only provides increased protection
against birthday attacks, but also offers a larger internal state for
entropy containment, as is needed for certain classes of pseudo-random
number generators~\cite{counterpane-prng}.

\section{Acknowledgements}

We are grateful to the Cryptix development team, particularly Ra\"{\i}f
Naffah, for carefully reading and suggesting improvements for the
implementation guidelines provided in this paper, and for implementing
several versions of {\Whirlpool} in Java.

We are deeply indebted to Brian Gladman for providingv software and
hardware facilities to search for efficient mini-box implementations in
terms of Boolean functions.

We would also like to thank the NESSIE project organisers and evaluation
team for making this work possible.

\begin{thebibliography}{99}

\bibitem{joan}J.~Daemen, ``Cipher and hash function design
strategies based on linear and differential cryptanalysis,''
\emph{Doctoral Dissertation}, March 1995, K.U.Leuven.

\bibitem{square}J.~Daemen, L.R.~Knudsen and V.~Rijmen, ``The block
cipher {\Square},'' \emph{Fast Software Encryption, LNCS~1267},
E.~Biham, Ed., Springer-Verlag, 1997, pp.~149--165.

\bibitem{rijndael}J.~Daemen and V.~Rijmen, ``AES proposal:
{\Rijndael},'' AES submission, 1998, {\tt http://www.nist.gov/aes}.

\bibitem{partial-sum}N.~Ferguson, J.~Kelsey, S.~Lucks, B.~Schneier,
M.~Stay, D.~Wagner, and D.~Whiting, ``Improved cryptanalysis of
{\Rijndael},'' to appear in \emph{Fast Software Encryption'00},
Springer-Verlag.

\bibitem{gilbert-minier}H.~Gilbert and M.~Minier, ``A collision attack
on 7 rounds of {\Rijndael},'' \emph{Third Advanced Encryption Standard
Candidate Conference}, NIST, April~2000, pp.~230--241.

\bibitem{cambridge-astronomy}M.~Hoskin, ``The Cambridge illustrated
history of astronomy,'' Cambridge University Press, 1997.

\bibitem{hw1}T.~Ichikawa, T.~Kasuya, M.~Matsui,
``Hardware evaluation of the AES finalists,'' \emph{Third
Advanced Encryption Standard Candidate Conference}, NIST,
April~2000, pp.~279--285.

\bibitem{interpolation}T.~Jakobsen and L.R.~Knudsen,
``The interpolation attack on block ciphers,'' \emph{Fast Software
Encryption, LNCS~1267}, E.~Biham, Ed., Springer-Verlag, 1997,
pp.~28--40.

\bibitem{counterpane-prng}J.~Kelsey, B.~Schneier, D.~Wagner,
C.~Hall, ``Cryptanalytic attacks on pseudorandom number
generators,'' \emph{Fast Software Encryption, LNCS~1372},
S.~Vaudenay , Ed., Springer-Verlag, 1998, pp.~168--188.

\bibitem{timing}P.C.~Kocher, ``Timing attacks on implementations of
{Diffie-Hellman}, {RSA}, {DSS}, and other systems,''
\emph{Advances in Cryptology, Crypto '96, LNCS~1109}, N. Koblitz,
Ed., Springer-Verlag, 1996, pp.~104--113.

\bibitem{power}P.~Kocher, J.~Jaffe, B.~Jun, ``Introduction to
differential power analysis and related attacks,'' available from
{\tt http://www.cryptography.com/dpa/technical/}.

\bibitem{lidl-niederreiter}R.~Lidl and H.~Niederreiter,
``Introduction to finite fields and their applications,''
Cambridge University Press, 1986.

\bibitem{macwilliams-sloane}F.J.~MacWilliams and N.J.A.~Sloane,
``The theory of error-correcting codes,'' \emph{North-Holland
Mathematical Library}, vol.~16, 1977.

\bibitem{hac}A.J.~Menezes, P.C.~van~Oorschot and S.A.~Vanstone,
``Handbook of Applied Cryptography,'' CRC Press, 1997.

\bibitem{nessie}NESSIE Project -- New European Schemes for Signatures,
Integrity and Encryption -- home page: \texttt{http://cryptonessie.org}.

\bibitem{nessie-lambda}NESSIE evaluation team, private communication, 2001.

\bibitem{preneel}B.~Preneel, ``Analysis and design of cryptographic
hash functions,'' \emph{Doctoral Dissertation}, January
1993, K.U.Leuven.

\bibitem{P93b}B.~Preneel, ``Differential cryptanalysis of hash
functions based on block ciphers,'' {\em Proceedings of the 1st
ACM Conference on Computer and Communications Security}, 1993,
pp.~183--188.

\bibitem{vincent}V.~Rijmen, ``Cryptanalysis and design of
iterated block ciphers,'' \emph{Doctoral Dissertation}, October
1997, K.U.Leuven.

\bibitem{vincent-hash}V.~Rijmen, B.~Preneel,
``Improved characteristics for differential cryptanalysis of hash
functions based on block ciphers,'' \emph{Fast Software
Encryption, LNCS~1008}, B. Preneel, Ed., Springer-Verlag, 1995,
pp.~242--248.

\bibitem{hw2}B.~Weeks, M.~Bean, T.~Rozylowicz, C.~Ficke,
``Hardware performance simulations of round 2 AES algorithms,''
\emph{Third Advanced Encryption Standard Candidate Conference},
NIST, April~2000, pp.~286--304.

\bibitem{whiting-aesforum}D.~Whiting, ``AES implementations in
0.25 micron ASIC,'' NIST AES electronic discussion forum posting,
August 2000.

\bibitem{whiting-email}D.~Whiting, private communication, 2001.

\bibitem{youssef-tavares-heys}A.M.~Youssef, S.E.~Tavares, and
H.M.~Heys, ``A new class of substitution-permutation networks,''
\emph{Workshop on Selected Areas in Cryptography, SAC'96},
Workshop record, 1996, pp.~132--147.

\end{thebibliography}

\appendix

\section{Generation of the {W\normalsize HIRLPOOL} S-box}

The only part of the S-box structure left unspecified in
figure~\ref{fig:whirlpool} is the $R$ permutation, which is generated
pseudo-randomly in a verifiable way.

The searching algorithm starts with a simple permutation without fixed
points (namely, the negation mapping $u \mapsto \bar{u} = u \oplus
\gf{F}$), and derives from it a sequence of $4 \times 4$ substitution
boxes (``mini-boxes'') with the optimal values $\delta = 1/4$,
$\lambda = 1/2$, and $\nu = 3$. Each such mini-box is combined with
$E$ and $E^{-1}$ according to the diagram shown in
figure~\ref{fig:whirlpool}; finally, the resulting $8 \times 8$ S-box,
if free of fixed points, is tested for the design criteria regarding
$\delta$, $\lambda$, and $\nu$.

Given a mini-box at any point during the search, a new one is derived
from it by choosing a pair of distinct values that are not the image of
one another and swapping them, keeping the result free of fixed points;
this is repeated until the running mini-box has optimal values of
$\delta$, $\lambda$, and $\nu$.

The pseudo-random number generator is implemented with
{\Rijndael}~\cite{rijndael} in counter mode, with a fixed key consisting
of 256 zero bits and an initial counter value consisting of 128 zero
bits.

The following pseudo-code fragment illustrates the computation of the
chain of mini-boxes and the resulting S-box:

\begin{tabbing}
    for \= for \= for \= for \= \kill
    \> // initialize $R$ to the negation permutation:\\%
    \> \textbf{for} ($u \leftarrow 0$; $u < 256$; $u\!+\!\!+$) \{\\
    \> \> $R[u] \leftarrow \bar{u}$;\\
    \> \}\\
    \> // look for S-box conforming to the design criteria:\\
    \> \textbf{do} \{\\
    \> \> // generate a random permutation free of fixed points:\\
    \> \> \textbf{do} \{\\
    \> \>    \> \textbf{do} \{\\
    \> \>    \>    \> // randomly select $x$ and $y$ such that\\
    \> \>    \>    \> // $x \neq y$, $R[x] \neq y$, and $R[y] \neq x$:\\
    \> \>    \>    \> $z \leftarrow$ RandomByte(); $x \leftarrow z \gg 4$; $y \leftarrow z \,\&\, \gf{0F}$;\\
    \> \>    \> \} \textbf{while} ($x = y \;\vee\; R[x] = y \;\vee\; R[y] = x$);\\
    \> \>    \> // swap entries:\\
    \> \>    \> $u \leftarrow R[x]; R[x] \leftarrow R[y]; R[y] \leftarrow u$;\\
    \> \> \} \textbf{while} ($\delta(R) > 1/4 \;\vee\; \lambda(R) > 1/2 \;\vee\; \nu(R) < 3$);\\
    \> \> // build S-box from the mini-boxes (see figure~\ref{fig:whirlpool}):\\
    \> \> $S \leftarrow$ WhirlStructure($E$, $R$);\\
    \> \> // test design criteria:\\
    \> \} \textbf{while} (\#FixedPoints$(S) > 0 \;\vee\; \delta(S) > 2^{-5} \;\vee\; \lambda(S) > 2^{-2} \;\vee\; \nu(S) < 7$);
\end{tabbing}

\section{Hardware implementation}\label{sbox-def}

Restricting the allowed logical gates to AND, OR, NOT, and XOR, the $E$
mini-box and its inverse can be implemented with 18 logical gates each,
while the $R$ mini-box needs 17 logical gates. Therefore, the complete
S-box can be implemented with 101 gates.

The pseudo-code fragments shown in figure~\ref{fig:ELR-hardware}
illustrate this ($u = u_3 x^3 + u_2 x^2 + u_1 x + u_0 \in \GF(2^4)$
denotes the mini-box input, $z = z_3 x^3 + z_2 x^2 + z_1 x + z_0 \in
\GF(2^4)$ denotes its output, and the $t_k$ denote intermediate values).
We point out, however, that the search for efficient Boolean expressions
for the mini-boxes has not been thorough, and it is likely that better
expressions exist.

\begin{figure}\centering
\begin{tabular}{|rcl|rcl|rcl|}\hline
$z$ & = & $E[u]$ & $z$ & = & $E^{-1}[u]$ & $z$ & = & $R[u]$\\\hline
$t_0$ & $\leftarrow$ & $u_0 \wedge u_2$ & $t_0$ & $\leftarrow$ & $\neg u_0$       & $t_0$ & $\leftarrow$ & $\neg u_0$\\
$t_0$ & $\leftarrow$ & $t_0 \oplus u_1$ & $t_1$ & $\leftarrow$ & $u_0 \vee u_1$   & $t_1$ & $\leftarrow$ & $u_2 \wedge u_3$\\
$t_2$ & $\leftarrow$ & $\neg u_0$       & $t_1$ & $\leftarrow$ & $t_1 \oplus u_3$ & $t_2$ & $\leftarrow$ & $u_0 \oplus t_1$\\
$t_1$ & $\leftarrow$ & $u_3 \oplus t_2$ & $t_2$ & $\leftarrow$ & $u_2 \wedge t_1$ & $t_2$ & $\leftarrow$ & $t_2 \vee u_1$\\
$t_2$ & $\leftarrow$ & $t_0 \vee t_1$   & $z_3$ & $\leftarrow$ & $t_0 \oplus t_2$ & $t_3$ & $\leftarrow$ & $u_3 \vee t_0$\\
$z_0$ & $\leftarrow$ & $u_0 \oplus t_2$ & $t_2$ & $\leftarrow$ & $u_0 \wedge u_2$ & $z_2$ & $\leftarrow$ & $t_2 \oplus t_3$\\
$t_2$ & $\leftarrow$ & $u_2 \wedge t_0$ & $t_3$ & $\leftarrow$ & $u_0 \vee u_3$   & $t_2$ & $\leftarrow$ & $\neg u_2$\\
$t_1$ & $\leftarrow$ & $t_1 \oplus t_2$ & $t_3$ & $\leftarrow$ & $t_3 \oplus t_2$ & $t_2$ & $\leftarrow$ & $t_2 \oplus t_3$\\
$t_2$ & $\leftarrow$ & $u_3 \vee z_0$   & $t_3$ & $\leftarrow$ & $t_3 \wedge u_1$ & $t_3$ & $\leftarrow$ & $u_1 \vee t_2$\\
$z_1$ & $\leftarrow$ & $t_2 \oplus t_1$ & $z_0$ & $\leftarrow$ & $t_0 \oplus t_3$ & $z_3$ & $\leftarrow$ & $t_1 \oplus t_3$\\
$t_2$ & $\leftarrow$ & $u_2 \oplus t_1$ & $t_2$ & $\leftarrow$ & $t_2 \oplus u_1$ & $t_3$ & $\leftarrow$ & $t_3 \oplus t_0$\\	
$t_1$ & $\leftarrow$ & $t_1 \oplus u_3$ & $t_3$ & $\leftarrow$ & $u_2 \oplus t_0$ & $t_0$ & $\leftarrow$ & $u_0 \vee z_3$\\
$t_0$ & $\leftarrow$ & $t_0 \oplus t_2$ & $t_4$ & $\leftarrow$ & $z_3 \oplus t_2$ & $t_1$ & $\leftarrow$ & $\neg u_1$\\
$t_1$ & $\leftarrow$ & $t_1 \vee t_0$   & $t_1$ & $\leftarrow$ & $t_1 \wedge t_4$ & $t_1$ & $\leftarrow$ & $t_1 \oplus u_3$\\
$z_2$ & $\leftarrow$ & $t_2 \oplus t_1$ & $t_2$ & $\leftarrow$ & $t_2 \vee t_1$   & $z_0$ & $\leftarrow$ & $t_0 \oplus t_1$\\
$t_1$ & $\leftarrow$ & $z_1 \wedge z_2$ & $z_2$ & $\leftarrow$ & $t_3 \oplus t_1$ & $t_3$ & $\leftarrow$ & $t_3 \vee z_0$\\
$t_1$ & $\leftarrow$ & $t_1 \vee z_0$   & $t_0$ & $\leftarrow$ & $t_0 \vee u_3$   & $z_1$ & $\leftarrow$ & $t_2 \oplus t_3$\\
$z_3$ & $\leftarrow$ & $t_0 \oplus t_1$ & $z_1$ & $\leftarrow$ & $t_0 \oplus t_2$ &       &              & \\\hline
\end{tabular}
\caption{Boolean expressions for $E$, $E^{-1}$, and $R$}\label{fig:ELR-hardware}
\end{figure}

For completeness, table~\ref{tab:S-box} lists the resulting $8 \times 8$
{\Whirlpool} S-box.

\begin{table}\centering
\caption{The {\Whirlpool} S-box}\label{tab:S-box}
\begin{tabular}{c|cccccccccccccccc|} \tt%
          & $\gf{00}$ & $\gf{01}$ & $\gf{02}$ & $\gf{03}$ & $\gf{04}$ & $\gf{05}$ & $\gf{06}$ & $\gf{07}$ & $\gf{08}$ & $\gf{09}$ & $\gf{0A}$ & $\gf{0B}$ & $\gf{0c}$ & $\gf{0d}$ & $\gf{0E}$ & $\gf{0F}$\\%
\hline
$\gf{00}$ & $\gf{18}$ & $\gf{23}$ & $\gf{c6}$ & $\gf{E8}$ & $\gf{87}$ & $\gf{B8}$ & $\gf{01}$ & $\gf{4F}$ & $\gf{36}$ & $\gf{A6}$ & $\gf{d2}$ & $\gf{F5}$ & $\gf{79}$ & $\gf{6F}$ & $\gf{91}$ & $\gf{52}$\\%
$\gf{10}$ & $\gf{60}$ & $\gf{Bc}$ & $\gf{9B}$ & $\gf{8E}$ & $\gf{A3}$ & $\gf{0c}$ & $\gf{7B}$ & $\gf{35}$ & $\gf{1d}$ & $\gf{E0}$ & $\gf{d7}$ & $\gf{c2}$ & $\gf{2E}$ & $\gf{4B}$ & $\gf{FE}$ & $\gf{57}$\\%
$\gf{20}$ & $\gf{15}$ & $\gf{77}$ & $\gf{37}$ & $\gf{E5}$ & $\gf{9F}$ & $\gf{F0}$ & $\gf{4A}$ & $\gf{dA}$ & $\gf{58}$ & $\gf{c9}$ & $\gf{29}$ & $\gf{0A}$ & $\gf{B1}$ & $\gf{A0}$ & $\gf{6B}$ & $\gf{85}$\\%
$\gf{30}$ & $\gf{Bd}$ & $\gf{5d}$ & $\gf{10}$ & $\gf{F4}$ & $\gf{cB}$ & $\gf{3E}$ & $\gf{05}$ & $\gf{67}$ & $\gf{E4}$ & $\gf{27}$ & $\gf{41}$ & $\gf{8B}$ & $\gf{A7}$ & $\gf{7d}$ & $\gf{95}$ & $\gf{d8}$\\%
$\gf{40}$ & $\gf{FB}$ & $\gf{EE}$ & $\gf{7c}$ & $\gf{66}$ & $\gf{dd}$ & $\gf{17}$ & $\gf{47}$ & $\gf{9E}$ & $\gf{cA}$ & $\gf{2d}$ & $\gf{BF}$ & $\gf{07}$ & $\gf{Ad}$ & $\gf{5A}$ & $\gf{83}$ & $\gf{33}$\\%
$\gf{50}$ & $\gf{63}$ & $\gf{02}$ & $\gf{AA}$ & $\gf{71}$ & $\gf{c8}$ & $\gf{19}$ & $\gf{49}$ & $\gf{d9}$ & $\gf{F2}$ & $\gf{E3}$ & $\gf{5B}$ & $\gf{88}$ & $\gf{9A}$ & $\gf{26}$ & $\gf{32}$ & $\gf{B0}$\\%
$\gf{60}$ & $\gf{E9}$ & $\gf{0F}$ & $\gf{d5}$ & $\gf{80}$ & $\gf{BE}$ & $\gf{cd}$ & $\gf{34}$ & $\gf{48}$ & $\gf{FF}$ & $\gf{7A}$ & $\gf{90}$ & $\gf{5F}$ & $\gf{20}$ & $\gf{68}$ & $\gf{1A}$ & $\gf{AE}$\\%
$\gf{70}$ & $\gf{B4}$ & $\gf{54}$ & $\gf{93}$ & $\gf{22}$ & $\gf{64}$ & $\gf{F1}$ & $\gf{73}$ & $\gf{12}$ & $\gf{40}$ & $\gf{08}$ & $\gf{c3}$ & $\gf{Ec}$ & $\gf{dB}$ & $\gf{A1}$ & $\gf{8d}$ & $\gf{3d}$\\%
$\gf{80}$ & $\gf{97}$ & $\gf{00}$ & $\gf{cF}$ & $\gf{2B}$ & $\gf{76}$ & $\gf{82}$ & $\gf{d6}$ & $\gf{1B}$ & $\gf{B5}$ & $\gf{AF}$ & $\gf{6A}$ & $\gf{50}$ & $\gf{45}$ & $\gf{F3}$ & $\gf{30}$ & $\gf{EF}$\\%
$\gf{90}$ & $\gf{3F}$ & $\gf{55}$ & $\gf{A2}$ & $\gf{EA}$ & $\gf{65}$ & $\gf{BA}$ & $\gf{2F}$ & $\gf{c0}$ & $\gf{dE}$ & $\gf{1c}$ & $\gf{Fd}$ & $\gf{4d}$ & $\gf{92}$ & $\gf{75}$ & $\gf{06}$ & $\gf{8A}$\\%
$\gf{A0}$ & $\gf{B2}$ & $\gf{E6}$ & $\gf{0E}$ & $\gf{1F}$ & $\gf{62}$ & $\gf{d4}$ & $\gf{A8}$ & $\gf{96}$ & $\gf{F9}$ & $\gf{c5}$ & $\gf{25}$ & $\gf{59}$ & $\gf{84}$ & $\gf{72}$ & $\gf{39}$ & $\gf{4c}$\\%
$\gf{B0}$ & $\gf{5E}$ & $\gf{78}$ & $\gf{38}$ & $\gf{8c}$ & $\gf{d1}$ & $\gf{A5}$ & $\gf{E2}$ & $\gf{61}$ & $\gf{B3}$ & $\gf{21}$ & $\gf{9c}$ & $\gf{1E}$ & $\gf{43}$ & $\gf{c7}$ & $\gf{Fc}$ & $\gf{04}$\\%
$\gf{c0}$ & $\gf{51}$ & $\gf{99}$ & $\gf{6d}$ & $\gf{0d}$ & $\gf{FA}$ & $\gf{dF}$ & $\gf{7E}$ & $\gf{24}$ & $\gf{3B}$ & $\gf{AB}$ & $\gf{cE}$ & $\gf{11}$ & $\gf{8F}$ & $\gf{4E}$ & $\gf{B7}$ & $\gf{EB}$\\%
$\gf{d0}$ & $\gf{3c}$ & $\gf{81}$ & $\gf{94}$ & $\gf{F7}$ & $\gf{B9}$ & $\gf{13}$ & $\gf{2c}$ & $\gf{d3}$ & $\gf{E7}$ & $\gf{6E}$ & $\gf{c4}$ & $\gf{03}$ & $\gf{56}$ & $\gf{44}$ & $\gf{7F}$ & $\gf{A9}$\\%
$\gf{E0}$ & $\gf{2A}$ & $\gf{BB}$ & $\gf{c1}$ & $\gf{53}$ & $\gf{dc}$ & $\gf{0B}$ & $\gf{9d}$ & $\gf{6c}$ & $\gf{31}$ & $\gf{74}$ & $\gf{F6}$ & $\gf{46}$ & $\gf{Ac}$ & $\gf{89}$ & $\gf{14}$ & $\gf{E1}$\\%
$\gf{F0}$ & $\gf{16}$ & $\gf{3A}$ & $\gf{69}$ & $\gf{09}$ & $\gf{70}$ & $\gf{B6}$ & $\gf{d0}$ & $\gf{Ed}$ & $\gf{cc}$ & $\gf{42}$ & $\gf{98}$ & $\gf{A4}$ & $\gf{28}$ & $\gf{5c}$ & $\gf{F8}$ & $\gf{86}$\\%
\hline
\end{tabular}
\end{table}

\section{The name}

{\Whirlpool} is named after the Whirlpool galaxy in Canes Venatici (M51,
or NGC~5194), the first one recognised to have spiral structure by
William Parsons, third Earl of Rosse, in April
1845~\cite{cambridge-astronomy}.

\end{document}
