View source for RIPEMD

{{Short description|Cryptographic hash function}}
{{Infobox cryptographic hash function
| name           = RIPEMD
| image          =
| caption        =
<!-- General -->
| designers      = Hans Dobbertin, Antoon Bosselaers and Bart Preneel
| publish date   = 1992
| series         =
| derived from   =
| derived to     =
| related to     =
| certification  = RIPEMD-160: [[CRYPTREC]] (Monitored)
<!-- Detail -->
| digest size    = 128, 160, 256, 320 bits
| structure      =
| rounds         =
| cryptanalysis  =
}}

[[File:RIPEMD 160 2.png|thumbnail|right|300px|A sub-block from the compression function of the RIPEMD-160 hash algorithm]]

'''RIPEMD''' ('''RIPE Message Digest''') is a family of [[Cryptographic hash function|cryptographic hash function]]s developed in 1992 (the original RIPEMD) and 1996 (other variants). There are five functions in the family: RIPEMD, RIPEMD-128, RIPEMD-160, RIPEMD-256, and RIPEMD-320, of which RIPEMD-160 is the most common.

The original RIPEMD, as well as RIPEMD-128, is not considered secure because 128-bit result is too small and also (for the original RIPEMD) because of design weaknesses. The 256- and 320-bit versions of RIPEMD provide the same level of security as RIPEMD-128 and RIPEMD-160, respectively; they are designed for applications where the security level is sufficient but longer hash result is necessary.

While RIPEMD functions are less popular than [[SHA-1]] and [[SHA-2]], they are used, among others, in [[Software:Bitcoin|Bitcoin]] and other cryptocurrencies based on Bitcoin.

== History ==

The original RIPEMD function was designed in the framework of the [[Social:European Union|EU]] project RIPE (RACE<!--RACE = Research and Development in Advanced Communications Technologies in Europe --> Integrity Primitives Evaluation) in 1992.<ref>{{cite conference|first1=Hans|last1=Dobbertin|first2=Antoon|last2=Bosselaers|first3=Bart|last3=Preneel|author-link3=Bart Preneel|title=RIPEMD-160: A strengthened version of RIPEMD|conference=Fast Software Encryption. Third International Workshop|location=Cambridge, UK|date=21–23 February 1996|pages=71–82|url=https://homes.esat.kuleuven.be/~bosselae/ripemd160/pdf/AB-9601/AB-9601.pdf|doi=10.1007/3-540-60865-6_44|doi-access=free}}</ref><ref>{{cite book|editor-first1=Antoon|editor-last1=Bosselaers|editor-first2=Bart|editor-last2=Preneel|title=Integrity Primitives for Secure Information Systems. Final Report of RACE Integrity Primitives Evaluation (RIPE-RACE 1040)|volume=1007|year=1995|doi=10.1007/3-540-60640-8|series=Lecture Notes in Computer Science|isbn=978-3-540-60640-6|last1=Bosselaers|first1=Antoon|last2=Preneel|first2=Bart|s2cid=12895857}}</ref> Its design was based on the [[MD4]] hash function. In 1996, in response to security weaknesses found in the original RIPEMD,<ref>{{cite journal|first=Hans|last=Dobbertin|author-link=Hans Dobbertin|title=RIPEMD with two-round compress function is not collision-free|date=December 1997|journal=[[Journal of Cryptology]]|volume=10|issue=1|pages=51–69|doi=10.1007/s001459900019|s2cid=15662054|doi-access=free}}</ref> Hans Dobbertin, Antoon Bosselaers and Bart Preneel at the [[Organization:COSIC|COSIC]] research group at the Katholieke Universiteit Leuven in Leuven, Belgium published four strengthened variants: RIPEMD-128, RIPEMD-160, RIPEMD-256, and RIPEMD-320.<ref>{{cite web|url=https://homes.esat.kuleuven.be/~bosselae/ripemd160.html|title=The hash function RIPEMD-160|first=Antoon|last=Bosselaers}}</ref>

In August 2004, a collision was reported for the original RIPEMD.<ref>{{Cite journal |last1=Wang |first1=Xiaoyun |last2=Feng |first2=Dengguo |last3=Lai |first3=Xuejia |author-link3=Xuejia Lai |last4=Yu |first4=Hongbo |date=2004-08-17 |title=Collisions for Hash Functions MD4, MD5, HAVAL-128 and RIPEMD |url=https://eprint.iacr.org/2004/199 |journal=[[Cryptology ePrint Archive]] |access-date=2017-03-03}}</ref> This does not apply to RIPEMD-160.<ref>{{Cite book |last1=Mendel |first1=Florian |last2=Pramstaller |first2=Norbert |last3=Rechberger |first3=Christian |last4=Rijmen |first4=Vincent |title=Information Security |chapter=On the Collision Resistance of RIPEMD-160 |series=Lecture Notes in Computer Science |author-link4=Vincent Rijmen |date=2006 |url=https://online.tugraz.at/tug_online/voe_main2.getvolltext?pCurrPk=17675 |volume=4176 |pages=101–116 |doi=10.1007/11836810_8 |access-date=2017-03-03 |doi-access=free|isbn=978-3-540-38341-3 }}</ref>

In 2019, the best collision attack for RIPEMD-160 could reach 34 rounds out of 80 rounds, which was published at CRYPTO 2019.<ref>{{Cite book |last1=Liu |first1=Fukang |last2=Dobraunig |first2=Christoph |last3=Mendel |first3=Florian |last4=Isobe |first4=Takanori |last5=Wang |first5=Gaoli |last6=Cao |first6=Zhenfu |title=Advances in Cryptology – CRYPTO 2019 |chapter=Efficient Collision Attack Frameworks for RIPEMD-160 |date=2019 |url=https://eprint.iacr.org/2018/652 |journal=Crypto 2019|series=Lecture Notes in Computer Science |volume=11693 |pages=117–149 |doi=10.1007/978-3-030-26951-7_5 |isbn=978-3-030-26950-0 |s2cid=51860634 }}</ref>

In February 2023, a collision attack for RIPEMD-160 was published at EUROCRYPT 2023, which could reach 36 rounds out of 80 rounds with time complexity of 2^64.5. <ref>{{cite book |last1=Liu |first1=Fukang |last2=Wang |first2=Gaoli |last3=Sarkar |first3=Santanu |last4=Anand |first4=Ravi |last5=Meier |first5=Willi |last6=Li |first6=Yingxin |last7=Isobe |first7=Takanori |title=Advances in Cryptology – EUROCRYPT 2023 |chapter=Analysis of RIPEMD-160: New Collision Attacks and Finding Characteristics with MILP |date=February 2023 |url=https://eprint.iacr.org/2023/277 |journal=Eurocrypt 2023|series=Lecture Notes in Computer Science |volume=14007 |pages=189–219 |doi=10.1007/978-3-031-30634-1_7 |isbn=978-3-031-30633-4 |s2cid=257235244 }}</ref>

==RIPEMD-160 hashes==
The 160-bit RIPEMD-160 hashes (also termed RIPE ''message digests'') are typically represented as 40-digit [[Hexadecimal|hexadecimal]] numbers. The following demonstrates a 43-byte [[ASCII]] input and the corresponding RIPEMD-160 hash:

  RIPEMD-160("The quick brown fox jumps over the lazy {{Background color|#87CEEB|d}}og") =
  37f332f68db77bd9d7edd4969571ad671cf9dd3b

RIPEMD-160 behaves with the desired avalanche effect of cryptographic hash functions (small changes, e.g. changing {{mono|d}} to {{mono|c}}, result in a completely different hash):

  RIPEMD-160("The quick brown fox jumps over the lazy {{Background color|#87CEEB|c}}og") =
  132072df690933835eb8b6ad0b77e7b6f14acad7

The hash of a zero-length string is:

  RIPEMD-160("") =
  9c1185a5c5e9fc54612808977ee8f548b2258d31

== Implementations ==
Below is a list of cryptography libraries that support RIPEMD (specifically RIPEMD-160):

* [[Software:Botan (programming library)|Botan]]
* [[Software:Bouncy Castle (cryptography)|Bouncy Castle]]
* [[Software:Cryptlib|Cryptlib]]
* [[Software:Crypto++|Crypto++]]
* [[Software:Libgcrypt|Libgcrypt]]
* [[Software:Mbed TLS|mbed TLS]]
* [[Software:Nettle (cryptographic library)|Nettle]]
* [[Software:OpenSSL|OpenSSL]]
* [[Software:WolfSSL|wolfSSL]]

==See also==
* [[Hash function security summary]]
* [[Comparison of cryptographic hash functions]]
*[[Comparison of cryptography libraries]]
* Topics in cryptography

==References==
{{reflist}}

==External links==
* [https://homes.esat.kuleuven.be/~bosselae/ripemd160.html The hash function RIPEMD-160]
* [https://ehash.iaik.tugraz.at/wiki/RIPEMD-160 RIPEMD-160 Ecrypt page]
* [https://homes.esat.kuleuven.be/~bosselae/ripemd/rmd128.txt RIPEMD-128bit Algorithm]

{{Cryptography navbox | hash}}

[[Category:Cryptographic hash functions]]

{{Sourceattribution|RIPEMD}}