Tiger-128 Hash

What is Tiger-128?

Tiger-128 is a cryptographic hash function introduced in 1995 by Ross Anderson and Eli Biham as part of the Tiger family, designed to address perceived weaknesses in MD4 and MD5. Structurally, it operates as a **128-bit hash** derived from a 3-pass compression function, where each pass processes the input message in 64-byte chunks (512 bits) using a non-linear mixing of three 32-bit registers (A, B, C) with a fixed 96-bit key schedule. The algorithm employs a **bitwise and modular addition** framework, incorporating a custom S-box and a non-linear mixing layer to resist linear and differential cryptanalysis. Unlike SHA-1 or MD5, Tiger-128 prioritizes **speed over security**, achieving high throughput on both CPUs and GPUs due to its parallelizable structure and lack of complex modular exponentiation. Its primary use-case was in lightweight applications where performance outweighed cryptographic robustness, such as checksum verification in file systems or basic integrity checks, though it never gained widespread adoption in security-critical systems.

Tiger-128’s vulnerabilities stem from its **design trade-offs and computational efficiency**, making it susceptible to brute-force and collision attacks. The absence of a **salt or keyed variant** renders it vulnerable to rainbow table precomputation, as identical inputs produce identical hashes without mitigation. Its **three-pass compression function** introduces **collision weaknesses**, with attacks like the **Biham-Bellare collision attack** exploiting the algorithm’s non-uniform output distribution to generate plausible hash collisions in sub-exponential time. Additionally, Tiger-128’s **parallel-friendly architecture** enables GPU-accelerated brute-force cracking, with modern hardware achieving **hash rates exceeding 100+ billion hashes per second** for 128-bit targets. The lack of **avalanche effect**—where small input changes drastically alter the output—further exacerbates predictability, allowing differential cryptanalysis to exploit bit-level patterns. Finally, its **pre-image resistance** is theoretically weaker than SHA-256 or BLAKE3, as the 128-bit output space is insufficient for modern computational resources, making recovery attacks feasible with optimized hardware.

Identifying Tiger-128 Hashes

Identifying a hash blindly is often difficult because multiple algorithms can output strings of the exact same length. For example, a standard 32-character hexadecimal string could be MD5, NTLM, MD4, or LM. To definitively identify Tiger-128, security researchers analyze the hash against a strict regular expression (regex) signature (shown above) to find structural matches.

How to Crack Tiger-128

If you need to recover the plaintext password for a Tiger-128 hash during a penetration test or forensics investigation, you must supply the correct module ID to your cracking software. Use the exact commands provided at the top of this page to target the hash successfully.