Paper 2013/600

Improved Cryptanalysis of Reduced RIPEMD-160

Florian Mendel, Thomas Peyrin, Martin Schläffer, Lei Wang, and Shuang Wu


In this article, we propose an improved cryptanalysis of the double-branch hash function standard RIPEMD-160. Using a carefully designed non-linear path search tool, we study the potential differential paths that can be constructed from a difference in a single message word and show that some of these message words can lead to very good differential path candidates. Leveraging the recent freedom degree utilization technique from Landelle and Peyrin to merge two branch instances, we eventually manage to obtain a semi-free-start collision attack for 42 steps of the RIPEMD-160 compression function, while the previously best know result reached 36 steps. In addition, we also describe a 36-step semi-free-start collision attack which starts from the first step.

Available format(s)
Secret-key cryptography
Publication info
A minor revision of an IACR publication in ASIACRYPT 2013
RIPEMD-160semi-free-start collisioncompression functionhash function
Contact author(s)
thomas peyrin @ gmail com
2013-09-19: received
Short URL
Creative Commons Attribution


      author = {Florian Mendel and Thomas Peyrin and Martin Schläffer and Lei Wang and Shuang Wu},
      title = {Improved Cryptanalysis of Reduced RIPEMD-160},
      howpublished = {Cryptology ePrint Archive, Paper 2013/600},
      year = {2013},
      note = {\url{}},
      url = {}
Note: In order to protect the privacy of readers, does not use cookies or embedded third party content.