A Fast New Cryptographic Hash Function (Designed in 1995)

In a response to many requests we publish Tiger2, which differs from Tiger only by the padding method, which is the same as in MD5/SHA. Test vectors for Tiger2 are given here.

Tiger is a fast new hash function, designed to be very fast on modern computers, and in particular on the state-of-the-art 64-bit computers (like DEC-Alpha), while it is still not slower than other suggested hash functions on 32-bit machines (well, not any more, after MD5 and SHA-1 were broken).

On DEC-Alpha, Tiger hashes more than 132Mbits per second (measured on Alpha 7000, Model 660, on one processor). On the same machine, MD5 hashes only about 37Mbps (this is probably not the best optimized md5 code). On 32-bit machines, the code of Tiger is not fully optimized. Still is hashes faster than MD5 on 486s and Pentiums. We conjecture that Tiger hashes faster than MD5 even on 16-bit machines. Performance of Tiger was measured by NESSIE. See tables and figures in pages 57, 70, and 108-118 of the NESSIE performance document.

Tiger has no usage restrictions nor patents. It can be used freely, with the reference implementation, with other implementations or with a modification to the reference implementation (as long as it still implements Tiger). We only ask you to let us know about your implementation and to cite the origin of Tiger and of the reference implementation.

We urge people to study the strength of Tiger; we will appreciate attacks, analysis and any other comments. This page will maintain the latest information on the current status of Tiger, an updated copy of the paper, reference implementations, and the S box generation program. You are welcome to look at this page once in a while to get the latest news.

The Paper and the C Code

Paper: HTML, Gzipped PostScript (Plain PostScript)
Reference Implementation: tar, zip
(This code is suitable for Alpha, and for most 32-bit machines using either the gcc or cc compilers).
Do not forget to check the definition of BIG_ENDIAN in the code, in case it needs change for your processor.
Note that this code fails on Misrosoft Visual Studio. You may see several proposed solutions from various people here.
If the above implementation does not compile on your compiler, you can try the emulation on 32-bit-only compilers: tar, zip.
Test Results for the Above Programs Note that these program do NOT define the way the output of Tiger is printed!!!
Test vectors for Tiger in the format of the The Nessie project. In these vectors the first (leftmost) printed byte is the first byte in the output array.
Test vectors for Tiger2.
The S Boxes Generation: Description, Reference Implementation
Note that in the original reference implementation that we have published in this page there was a typo that used the wrong bit order when it padded the '1' bit at the end of the message. It used the constant 0x80, rather than 0x01 to append this bit. The reference implementation and test results given above are already corrected. We are grateful to John Lull who found this typo.
ASN.1 OID's for Tiger and Serpent

Perl interface (thanks to Clinton Wong)
A source code in Java is available from Cryptix.
Some other implementations of Tiger (we did not check them): Tiger for Z80

The authors' home pages can be found both in http://www.cs.technion.ac.il/~biham/ and in http://www.cl.cam.ac.uk/users/rja14/.