Editing Whirlpool (hash function) (section)

== Design features ==
[[File:Messier51 sRGB.jpg|thumb|190px|right|The [[Whirlpool Galaxy]] (M51), which inspired the name of the algorithm.<ref name="whirlpoolpg">{{cite web
| url=http://www.larc.usp.br/~pbarreto/WhirlpoolPage.html
| title=The WHIRLPOOL Hash Function
| author=Paulo S. L. M. Barreto
| date=2008-11-25
| archive-url=https://web.archive.org/web/20171129084214/http://www.larc.usp.br/~pbarreto/WhirlpoolPage.html
| archive-date=2017-11-29
| url-status=dead
| access-date=2018-08-09}}</ref>]]

Whirlpool is a hash designed after the [[Square (cipher)|Square]] [[block cipher]], and is considered to be in that family of block cipher functions. 

Whirlpool is a [[One-way compression function#Miyaguchi–Preneel|Miyaguchi-Preneel]] construction based on a substantially modified [[Advanced Encryption Standard]] (AES). 

Whirlpool takes a message of any length less than 2<sup>256</sup> bits and returns a 512-bit [[message digest]].<ref>{{cite journal
| author1=Barreto, Paulo S. L. M.
| author2=Rijmen, Vincent
| name-list-style=amp
| title=The WHIRLPOOL Hashing Function
| date=2003-05-24
| url=http://www.larc.usp.br/~pbarreto/whirlpool.zip
| format=ZIP
| archive-url=https://web.archive.org/web/20171026140501/http://www.larc.usp.br/%7Epbarreto/whirlpool.zip
| archive-date=2017-10-26
| url-status=dead
| access-date=2018-08-09}}</ref>

The authors have declared that
:"WHIRLPOOL is not (and will never be) [[Patent|patented]]. It may be used free of charge for any purpose."<ref name="whirlpoolpg" />

=== Version changes ===
The original Whirlpool will be called ''Whirlpool-0'', the first revision of Whirlpool will be called ''Whirlpool-T'' and the latest version will be called ''Whirlpool'' in the following test vectors.

* In the first revision in 2001, the [[S-box]] was changed from a randomly generated one with good cryptographic properties to one which has better cryptographic properties and is easier to implement in hardware.
* In the second revision (2003), a flaw in the [[MDS matrix|diffusion matrix]] was found that lowered the estimated security of the algorithm below its potential.<ref>{{cite journal
| title=On the diffusion matrix employed in the Whirlpool hashing function
| author1=Kyoji, Shibutani
| author2=Shirai, Taizo
| name-list-style=amp
| date=2003-03-11
| url=https://www.cosic.esat.kuleuven.be/nessie/reports/phase2/whirlpool-20030311.pdf
| access-date=2018-08-09}}
</ref> Changing the 8x8 rotating matrix constants from (1, 1, 3, 1, 5, 8, 9, 5) to (1, 1, 4, 1, 8, 5, 2, 9) solved this issue.