doc: Add RFC documents

1 files changed, 955 insertions, 0 deletions

diff --git a/doc/rfc/rfc5831.txt b/doc/rfc/rfc5831.txt
new file mode 100644
index 0000000..5954d5e
--- /dev/null
+++ b/doc/rfc/rfc5831.txt
@@ -0,0 +1,955 @@
+
+
+
+
+
+
+Independent Submission                                  V. Dolmatov, Ed.
+Request for Comments: 5831                               Cryptocom, Ltd.
+Category: Informational                                       March 2010
+ISSN: 2070-1721
+
+
+                GOST R 34.11-94: Hash Function Algorithm
+
+Abstract
+
+   This document is intended to be a source of information about the
+   Russian Federal standard hash function (GOST R 34.11-94), which is
+   one of the Russian cryptographic standard algorithms (called GOST
+   algorithms).  Recently, Russian cryptography is being used in
+   Internet applications, and this document has been created as
+   information for developers and users of GOST R 34.11-94 for hash
+   computation.
+
+Status of This Memo
+
+   This document is not an Internet Standards Track specification; it is
+   published for informational purposes.
+
+   This is a contribution to the RFC Series, independently of any other
+   RFC stream.  The RFC Editor has chosen to publish this document at
+   its discretion and makes no statement about its value for
+   implementation or deployment.  Documents approved for publication by
+   the RFC Editor are not a candidate for any level of Internet
+   Standard; see Section 2 of RFC 5741.
+
+   Information about the current status of this document, any errata,
+   and how to provide feedback on it may be obtained at
+   http://www.rfc-editor.org/info/rfc5831.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+Dolmatov                      Informational                     [Page 1]
+
+RFC 5831                     GOST R 34.11-94                  March 2010
+
+
+Copyright Notice
+
+   Copyright (c) 2010 IETF Trust and the persons identified as the
+   document authors.  All rights reserved.
+
+   This document is subject to BCP 78 and the IETF Trust's Legal
+   Provisions Relating to IETF Documents
+   (http://trustee.ietf.org/license-info) in effect on the date of
+   publication of this document.  Please review these documents
+   carefully, as they describe your rights and restrictions with respect
+   to this document.
+
+   This document may not be modified, and derivative works of it may not
+   be created, except to format it for publication as an RFC or to
+   translate it into languages other than English.
+
+Table of Contents
+
+   1. Introduction ....................................................3
+      1.1. General Information ........................................3
+      1.2. The Purpose of GOST R 34.11-94 .............................3
+   2. Applicability ...................................................3
+   3. Conventions Used in This Document ...............................4
+   4. General Statements ..............................................5
+   5. Step-by-Step Hash Function ......................................5
+      5.1. Key Generation .............................................5
+      5.2. Encryption Transformation ..................................7
+      5.3. Mixing Transformation ......................................7
+   6. The Calculation Procedure for a Hash Function ...................8
+   7. Test Examples (Informative) .....................................9
+      7.1. Usage of the Algorithm GOST 28147-89 ......................10
+      7.2. Representation of Vectors .................................11
+      7.3. Examples of the Hash Value Calculation ....................11
+           7.3.1. Hash Calculation for the Sample Message M ..........11
+           7.3.2. Hash Calculation for the Sample Message M ..........14
+   8. Security Considerations ........................................16
+   9. Normative References ...........................................16
+   10. Contributors ..................................................17
+
+
+
+
+
+
+
+
+
+
+
+
+
+Dolmatov                      Informational                     [Page 2]
+
+RFC 5831                     GOST R 34.11-94                  March 2010
+
+
+1.  Introduction
+
+1.1.  General Information
+
+   1. GOST R 34.11-94  [GOST3411] was developed by the Federal Agency
+      for Government Communication and Information and by the All-Russia
+      Scientific and Research Institute of Standardization.
+
+   2. GOST R 34.11-94 was accepted and activated by Act 154 of
+      23.05.1994 issued by the Russian Federal committee for standards.
+
+1.2.  The Purpose of GOST R 34.11-94
+
+   Expanding the application of information technologies when creating,
+   processing, and storing documents requires, in some cases,
+   confidentiality of their contents, maintenance of completeness, and
+   authenticity.
+
+   Cryptography (cryptographic security) is one of the effective
+   approaches for data security.  It is widely applied in different
+   areas of government and commercial activity.
+
+   Cryptographic data security methods are under serious scientific
+   research and standardization efforts at national, regional, and
+   international levels.
+
+   GOST R 34.11-94 defines a hash function calculation procedure for an
+   arbitrary sequence of binary symbols.
+
+   The hash function maps an arbitrary set of data represented as a
+   sequence of binary symbols onto its image of a fixed small length.
+
+   Thus, hash functions can be used in procedures related to the
+   electronic digital signature, resulting in considerable reduction of
+   elapsed time for the sign and verify stages.  The effect of the
+   reduction of time is due to the fact that only a short image of
+   initial data is actually signed.
+
+2.  Applicability
+
+   GOST R 34.11-94 defines an algorithm and procedure for the
+   calculation of a hash function for an arbitrary sequence of binary
+   symbols.  These algorithms and procedures should be applied in
+   cryptographic methods of data processing and securing, including
+   digital signature procedures employed for data transfer and data
+   storage in computer-aided systems.
+
+
+
+
+
+Dolmatov                      Informational                     [Page 3]
+
+RFC 5831                     GOST R 34.11-94                  March 2010
+
+
+   The hash function, defined in GOST R 34.11-94, is used for digital
+   signature systems based on the asymmetric cryptographic algorithm
+   according to GOST R 34.10-2001 (see section 3).
+
+3.  Conventions Used in This Document
+
+   The following notations are used in GOST R 34.11-94:
+
+   V_all is a set of all finite words in the alphabet V = {0,1}.  The
+   words are read from right to left and the alphabet symbols are
+   numbered from right to left (i.e., the rightmost symbol of the word
+   has the number one, the second rightmost symbol has number two,
+   etc.).
+
+   Vk is a set of all words in alphabet V = {0,1} of length k bits
+   (k=16,64,256).
+
+   |A| is the length of a word A belonging to V_all.
+
+   A||B is a concatenation of words A, B belonging to V_all.  Its length
+   is |A| + |B|, where the left |A| symbols come from the word A, and
+   the right |B| symbols come from the word B.  One can also use the
+   notation A||B = A * B.
+
+   A^k is a concatenation of k copies of the word A (A belongs to
+   V_all).
+
+   <N>_k is a word of length k, containing a binary representation of
+   N(mod 2^k) residue, with a non-negative integer N.
+
+   A^$ is a non-negative integer with A as its binary representation.
+
+   (xor) is the bitwise modulo 2 addition of the words of the same
+   length.
+
+   (+)' is the addition according to the rule A (+)' B = <A^$+ B^$>_k,
+   where k = |A| = |B|.
+
+   M is a binary sequence to be hashed, M belongs to V_all.  M is a
+   message in digital signature systems.
+
+   h is a hash function that maps the sequence M belonging to V_all onto
+   the word h(M) belonging to V_256.
+
+   E(k,A) is a result of the encryption of the word A using key K with
+   the encryption algorithm according to [GOST28147] in the electronic
+   codebook (ECB) mode (K belongs to V256, A belongs to V64).
+
+
+
+
+Dolmatov                      Informational                     [Page 4]
+
+RFC 5831                     GOST R 34.11-94                  March 2010
+
+
+   h0 is an initial hash value.
+
+   e := g is the assignment of the value g to the parameter e.
+
+   ^ is the power operator.
+
+   i = 1..8 is an interval with i being all the values from 1 to 8.
+
+   hUZ is the S-boxes described in [GOST28147].
+
+4.  General Statements
+
+   A hash function h is the mapping h :  V_all -> V256, depending on the
+   parameter (which is the initial hash value H, H is a word from V256).
+   To define the hash function, it is necessary to have:
+
+      - a calculation algorithm for the step-by-step hash function
+
+        chi : V256 x V256 ->  V256
+
+      - a description of an iterative procedure for calculating the hash
+        value h
+
+   A hash function h depends on two parameters, h0 and hUZ.
+
+5.  Step-by-Step Hash Function
+
+   A calculation algorithm for the step-by-step hash function contains
+   three parts, which successively do:
+
+      - key generation, here keys are 256-bit words;
+
+      - an encryption transformation, that is encryption of 64-bit
+        subwords of word H using keys K[i], (i = 1, 2, 3, 4) with the
+        algorithm according to [GOST28147] in ECB mode; and
+
+      - a mixing transformation for the result of the encryption.
+
+5.1  Key Generation
+
+   Consider X = (b[256], b[255], ..., b[1]) belongs to V256.
+
+   Let:
+
+      X = x[4]||x[3]||x[2]||x[1] = eta[16]||[eta15]||...||eta[1]
+
+        = xi[32]||xi[31]||...||xi[1], where
+
+
+
+
+Dolmatov                      Informational                     [Page 5]
+
+RFC 5831                     GOST R 34.11-94                  March 2010
+
+
+        x[i] = (b[i*64],...,b[(i-1)*64+1]) belongs to V64, i = 1..4,
+
+      eta[j] = (b[j*16],...,b[(j-1)*16+1]) belongs to V16, j = 1..16,
+
+       xi[k] = (b[k*8],..., b[(k-1)*8+1]) belongs to V8, k = 1..32.
+
+   Yet, another notation: A(X) = (x[1](xor)x[2])||x[4]||x[3]||x[2].
+
+   The transformation P : V256 -> V256 maps the word xi32||...||xi1
+   onto the word xi[phi(32)] || ... || xi[phi(1)],
+
+   where phi(i + 1 + 4 ( k - 1) ) = 8i + k , i = 0..3, k = 1..8.
+
+   For the key generation, one should use the following initial data:
+
+      - words H, M belonging to V256,
+
+      - parameters: words C[i] (i = 2, 3, 4), with values:
+
+        C[2] = C[4] = 0^256;
+
+        C[3] = 1^8||0^8||1^16||0^24||1^16||0^8||(0^8||1^8)^2||1^8||0^8
+               ||(0^8||1^8)^4||(1^8||0^8 )^4.
+
+   The following algorithm is used for the key calculation:
+
+   1. Assign values:
+
+      i := 1, U := H , V := M.
+
+   2. Calculate:
+
+      W = U (xor) V , K[i] = P(W).
+
+   3. Assign:
+
+      i := i + 1.
+
+   4. Verify condition:
+
+      i = 5.
+
+   If it is true, go to step 7.  If not, go to step 5.
+
+   5. Calculate:
+
+      U := A(U)(xor)C[i], V := A(A(V)),
+      W := U(xor)V, K[i] = P(W).
+
+
+
+Dolmatov                      Informational                     [Page 6]
+
+RFC 5831                     GOST R 34.11-94                  March 2010
+
+
+   6. Go to step 3.
+
+   7. End.
+
+5.2.  Encryption Transformation
+
+   At this stage, 64-bit subwords of the word H are encrypted using keys
+   K[i] (i = 1, 2, 3, 4).
+
+   For the encryption transformation, one should use the following
+   initial data:
+
+      H = h[4]||h[3]||h[2]||h[1],
+
+   where h[i] belongs to V64, i = 1,2,3,4, and a key set is K[1], K[2],
+   K[3], K[4].
+
+   The encryption algorithm is applied and the following words are
+   obtained:
+
+      s[i] = E(K[i],h[i]), where: i = 1,2,3,4
+
+   As a result of the stage, the following sequence is formed:
+
+      S = s[4]||s[3]||s[2]||s[1].
+
+5.3.  Mixing Transformation
+
+   At this stage, the obtained sequence is mixed using a shift register.
+
+   The initial data includes words H, M belonging to V256 and a word S
+   belonging to V256 .
+
+   Let a mapping PSI(X) : V256(2) -> V256(2) transform the word:
+
+      eta[16]||eta[15]||...||eta[1], eta[i] belongs to V16, i = 1..16
+
+   into the word:
+
+      eta[1](xor)eta[2](xor)eta[3](xor)eta[4](xor)eta[13](xor)eta[16]
+      ||eta[16]||...||eta[2].
+
+   Then, the value of the step-by-step hash function value is the word:
+
+      chi(M, H) =  PSI^61(H(xor)PSI(M(xor)PSI^12(S))),
+
+   where PSI^i(X) is the transformation PSI applied i times to X.
+
+
+
+
+Dolmatov                      Informational                     [Page 7]
+
+RFC 5831                     GOST R 34.11-94                  March 2010
+
+
+6.  The Calculation Procedure for a Hash Function
+
+   The calculation procedure for a hash function h is assumed to be
+   applied to a sequence M belonging to V_all.  Its parameter is an
+   initial hash value h0, which is an arbitrarily fixed word from V256.
+
+   The calculation procedure for the function h uses the following
+   quantities at each step of iteration:
+
+   _M_ belonging to V_all - a part of the sequence M, which was not
+   hashed at previous iterations;
+
+   H belonging to V256 - the current hash value;
+
+   SIGMA belonging to V256 - the current check sum value;
+
+   L belonging to V256 - the length of the partial sequence M processed
+   at the previous iteration step.
+
+   The calculation algorithm for function h consists of the following
+   steps:
+
+   Step 1. Assign initial values to current quantities:
+
+      1.1 _M_ := M.
+
+      1.2 H := h0.
+
+      1.3 SIGMA := 0^256.
+
+      1.4 L := 0^256.
+
+      1.5 Go to step 2.
+
+   Step 2.
+
+      2.1 Verify the condition |_M_|>256.
+
+   If it is true, go to step 3.
+
+   Else, make the following calculations:
+
+      2.2 L := <L^$ + |M|>_256
+
+      2.3 M' := 0^(256 -|M|)||M
+
+      2.4 SIGMA := SIGMA (+)' M'
+
+
+
+
+Dolmatov                      Informational                     [Page 8]
+
+RFC 5831                     GOST R 34.11-94                  March 2010
+
+
+      2.5 H := chi (M', H)
+
+      2.6 H := chi (L, H)
+
+      2.7 H := chi (SIGMA, H)
+
+      2.8 End.
+
+   Step 3.
+
+      3.1 Calculate a subword M_s belonging to V256 of the word _M_
+          (_M_ = M_p||M_s).  Then make the following calculations:
+
+      3.2 H := chi (M_s, H)
+
+      3.3 L := <L^$ + 256>_256
+
+      3.4 SIGMA := SIGMA (+)' M[s]
+
+      3.5 _M_ = M_p
+
+      3.6 Go to step 2.
+
+   The quantity H obtained at step 2.7 is the value of the hash function
+   h(M).
+
+7.  Test Examples (Informative)
+
+   It is recommended to use the values for substitution units pi[1],
+   pi[2],..., pi[8] and the initial hash value H described in this
+   appendix for the GOST R 34.11-94 test examples only.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+Dolmatov                      Informational                     [Page 9]
+
+RFC 5831                     GOST R 34.11-94                  March 2010
+
+
+7.1.  Usage of the Algorithm GOST 28147-89
+
+   The algorithm GOST 28147-89 [GOST28147] in ECB mode is used as an
+   encryption transformation in the following examples.  The following
+   values of the substitution units pi[1], pi[2],..., pi[8] have been
+   chosen:
+
+           8 7 6 5 4 3 2 1
+
+       0   1 D 4 6 7 5 E 4
+
+       1   F B B C D 8 B A
+
+       2   D 4 A 7 A 1 4 9
+
+       3   0 1 0 1 1 D C 2
+
+       4   5 3 7 5 0 A 6 D
+
+       5   7 F 2 F 8 3 D 8
+
+       6   A 5 1 D 9 4 F 0
+
+       7   4 9 D 8 F 2 A E
+
+       8   9 0 3 4 E E 2 6
+
+       9   2 A 6 A 4 F 3 B
+
+      10   3 E 8 9 6 C 8 1
+
+      11   E 7 5 E C 7 1 C
+
+      12   6 6 9 0 B 6 0 7
+
+      13   B 8 C 3 2 0 7 F
+
+      14   8 2 F B 5 9 5 5
+
+      15   C C E 2 3 B 9 3
+
+   The hexadecimal value of pi[j](i) is given in a column number j,
+
+      j = 1..8, and in a row number i, i = 0..15.
+
+
+
+
+
+
+
+Dolmatov                      Informational                    [Page 10]
+
+RFC 5831                     GOST R 34.11-94                  March 2010
+
+
+7.2.  Representation of Vectors
+
+   We will put down binary symbol sequences as hexadecimal digits
+   strings, where each digit corresponds to four signs of its binary
+   representation.
+
+7.3 Examples of the Hash Value Calculation
+
+   A zero vector, for example, can be taken as an initial hash value:
+
+   h0 = 00000000 00000000 00000000 00000000
+        00000000 00000000 00000000 00000000
+
+7.3.1.  Hash Calculation for the Sample Message M
+
+   M = 73657479 62203233 3D687467 6E656C20
+       2C656761 7373656D 20736920 73696854
+
+   Initial values are assigned for the text:
+
+   _M_   = 73657479 62203233 3D687467 6E656C20
+           2C656761 7373656D 20736920 73696854
+
+   for the hash function:
+
+   H   = 00000000 00000000 00000000 00000000
+         00000000 00000000 00000000 00000000
+
+   for the sum of text blocks:
+
+
+   SIGMA = 00000000 00000000 00000000 00000000
+           00000000 00000000 00000000 00000000
+
+   for the length of the text:
+
+   L = 00000000 00000000 00000000 00000000
+       00000000 00000000 00000000 00000000
+
+   If the length of the message to be hashed equals 256 bits (32 bytes),
+   then:
+
+   L = 00000000 00000000 00000000 00000000
+       00000000 00000000 00000000 00000100
+
+   M' = _M_ = 73657479 62203233 3D687467 6E656C20
+              2C656761 7373656D 20736920 73696854
+
+
+
+
+Dolmatov                      Informational                    [Page 11]
+
+RFC 5831                     GOST R 34.11-94                  March 2010
+
+
+   and there is no need to pad the current block with zeroes:
+
+   SIGMA=M' = 73657479 62203233 3D687467 6E656C20
+               2C656761 7373656D 20736920 73696854
+
+   The step-by-step hash function chi(M, N) values are calculated.
+
+   The keys are generated:
+
+   K[1] = 733D2C20 65686573 74746769 326C6568
+          626E7373 20657369 79676120 33206D54
+
+   K[2] = 110C733D 0D166568 130E7474 06417967
+          1D00626E 161A2065 090D326C 4D393320
+
+   K[3] = 80B111F3 730DF216 850013F1 C7E1F941
+          620C1DFF 3ABAE91A 3FA109F2 F513B239
+
+   K[4] = A0E2804E FF1B73F2 ECE27A00 E7B8C7E1
+          EE1D620C AC0CC5BA A804C05E A18B0AEC
+
+   The 64-bit subwords of block H are encrypted by the algorithm
+   according to GOST 28147.
+
+   Block h[1] = 00000000 00000000 is encrypted using key K[1] and
+   s[1] = 42ABBCCE 32BC0B1B is obtained.
+
+   Block h[2] = 00000000 00000000 is encrypted using key K[2] and
+   s[2] = 5203EBC8 5D9BCFFD is obtained.
+
+   Block h[3] = 00000000 00000000 is encrypted using key K[3] and
+   s[3] = 8D345899 00FF0E28 is obtained.
+
+   Block h[4] = 00000000 00000000 is encrypted using key K[4] and
+   s[4] = E7860419 0D2A562D is obtained.
+
+   So S = E7860419 0D2A562D 8D345899 00FF0E28
+          5203EBC8 5D9BCFFD 42ABBCCE 32BC0B1B
+
+   is obtained.
+
+   The mixing transformation using a shift register is performed and
+
+   KSI = chi(M, H) = CF9A8C65 505967A4 68A03B8C 42DE7624
+                     D99C4124 883DA687 561C7DE3 3315C034
+
+   is obtained.
+
+
+
+
+Dolmatov                      Informational                    [Page 12]
+
+RFC 5831                     GOST R 34.11-94                  March 2010
+
+
+   Assign H = KSI and calculate chi(L, H):
+
+   K[1] = CF68D956 9AA09C1C 8C3B417D 658C24E3
+          50428833 59DE3D15 6776A6C1 A4248734
+
+   K[2] = 8FCF68D9 809AA09C 3C8C3B41 C7658C24
+          BB504288 2859DE3D 666676A6 B3A42487
+
+   K[3] = 4E70CF97 3C8065A0 853C8CC4 57389A8C
+          CABB50BD E3D7A6DE D1996788 5CB35B24
+
+   K[4] = 584E70CF C53C8065 48853C8C 1657389A
+          EDCABB50 78E3D7A6 EED19867 7F5CB35B
+
+   S    = 66B70F5E F163F461 468A9528 61D60593
+          E5EC8A37 3FD42279 3CD1602D DD783E86
+
+   KSI  = 2B6EC233 C7BC89E4 2ABC2692 5FEA7285
+          DD3848D1 C6AC997A 24F74E2B 09A3AEF7
+
+   Now assign H = KSI again and calculate chi( SIGMA, H):
+
+   K[1] = 5817F104 0BD45D84 B6522F27 4AF5B00B
+          A531B57A 9C8FDFCA BB1EFCC6 D7A517A3
+
+   K[2] = E82759E0 C278D950 15CC523C FC72EBB6
+          D2C73DA8 19A6CAC9 3E8440F5 C0DDB65A
+
+   K[3] = 77483AD9 F7C29CAA EB06D1D7 841BCAD3
+          FBC3DAA0 7CB555F0 D4968080 0A9E56BC
+
+   K[4] = A1157965 2D9FBC9C 088C7CC2 46FB3DD2
+          7684ADCB FA4ACA06 53EFF7D7 C0748708
+
+   S    = 2AEBFA76 A85FB57D 6F164DE9 2951A581
+          C31E7435 4930FD05 1F8A4942 550A582D
+
+   KSI  = FAFF37A6 15A81669 1CFF3EF8 B68CA247
+          E09525F3 9F811983 2EB81975 D366C4B1
+
+   Then, the hash result is:
+
+   H    = FAFF37A6 15A81669 1CFF3EF8 B68CA247
+          E09525F3 9F811983 2EB81975 D366C4B1
+
+
+
+
+
+
+
+Dolmatov                      Informational                    [Page 13]
+
+RFC 5831                     GOST R 34.11-94                  March 2010
+
+
+7.3.2.  Hash Calculation for the Sample Message M
+
+   Let M = 7365 74796220 3035203D 20687467 6E656C20
+                73616820 65676173 73656D20 6C616E69
+                6769726F 20656874 2065736F 70707553
+
+   As the length of the message to be hashed equals 400 bits (50 bytes),
+   the message is divided into two blocks, and the second (high-order)
+   one is padded with zeroes.  During the calculations the following
+   numbers are obtained:
+
+   STEP 1.
+
+   H    = 00000000 00000000 00000000 00000000
+          00000000 00000000 00000000 00000000
+
+   M_s = 73616820 65676173 73656D20 6C616E69
+         6769726F 20656874 2065736F 70707553
+
+   K[1] = 73736720 61656965 686D7273 20206F6F
+          656C2070 67616570 616E6875 73697453
+
+   K[2] = 14477373 0C0C6165 1F01686D 4F002020
+          4C50656C 04156761 061D616E 1D277369
+
+   K[3] = CBFF14B8 6D04F30C 96051FFE DFFFB000
+          35094CAF 72F9FB15 7CF006E2 AB1AE227
+
+   K[4] = EBACCB00 F7006DFB E5E16905 B0B0DFFF
+          BA1C3509 FD118DF9 F61B830F F8C554E5
+
+   S    = FF41797C EEAADAC2 43C9B1DF 2E14681C
+          EDDC2210 1EE1ADF9 FA67E757 DAFE3AD9
+
+   KSI  = F0CEEA4E 368B5A60 C63D96C1 E5B51CD2
+          A93BEFBD 2634F0AD CBBB69CE ED2D5D9A
+
+   STEP 2.
+
+   H    = F0CEEA4E 368B5A60 C63D96C1 E5B51CD2
+          A93BEFBD 2634F0AD CBBB69CE ED2D5D9A
+
+   M'   = 00000000 00000000 00000000 00007365
+          74796220 3035203D 20687467 6E656C20
+
+   K[1] = F0C6DDEB CE3D42D3 EA968D1D 4EC19DA9
+          36E51683 8BB50148 5A6FD031 60B790BA
+
+
+
+
+Dolmatov                      Informational                    [Page 14]
+
+RFC 5831                     GOST R 34.11-94                  March 2010
+
+
+   K[2] = 16A4C6A9 F9DF3D3B E4FC96EF 5309C1BD
+          FB68E526 2CDBB534 FE161C83 6F7DD2C8
+
+   K[3] = C49D846D 1780482C 9086887F C48C9186
+          9DCB0644 D1E641E5 A02109AF 9D52C7CF
+
+   K[4] = BDB0C9F0 756E9131 E1F290EA 50E4CBB1
+          1CAD9536 F4E4B674 99F31E29 70C52AFA
+
+   S    = 62A07EA5 EF3C3309 2CE1B076 173D48CC
+          6881EB66 F5C7959F 63FCA1F1 D33C31B8
+
+   KSI  = 95BEA0BE 88D5AA02 FE3C9D45 436CE821
+          B8287CB6 2CBC135B 3E339EFE F6576CA9
+
+   STEP 3.
+
+   H    = 95BEA0BE 88D5AA02 FE3C9D45 436CE821
+          B8287CB6 2CBC135B 3E339EFE F6576CA9
+
+   L    = 00000000 00000000 00000000 00000000
+          00000000 00000000 00000000 00000190
+
+   K[1] = 95FEB83E BE3C2833 A09D7C9E BE45B6FE
+          88432CF6 D56CBC57 AAE8136D 02215B39
+
+   K[2] = 8695FEB8 1BBE3C28 E2A09D7C 48BE45B6
+          DA88432C EBD56CBC 7FABE813 F292215B
+
+   K[2] = 8695FEB8 1BBE3C28 E2A09D7C 48BE45B6
+          DA88432C EBD56CBC 7FABE813 F292215B
+
+   K[3] = B9799501 141B413C 1EE2A062 0CB74145
+          6FDA88BC D0142A6C FA80AA16 15F2FDB1
+
+   K[4] = 94B97995 7D141B41 C21EE2A0 040CB741
+          346FDA88 46D0142A BDFA81AA DC1562FD
+
+   S    = D42336E0 2A0A6998 6C65478A 3D08A1B9
+          9FDDFF20 4808E863 94FD9D6D F776A7AD
+
+   KSI  = 47E26AFD 3E7278A1 7D473785 06140773
+          A3D97E7E A744CB43 08AA4C24 3352C745
+
+   STEP 4.
+
+   H    = 47E26AFD 3E7278A1 7D473785 06140773
+          A3D97E7E A744CB43 08AA4C24 3352C745
+
+
+
+Dolmatov                      Informational                    [Page 15]
+
+RFC 5831                     GOST R 34.11-94                  March 2010
+
+
+   SIGMA = 73616820 65676173 73656D20 6C61E1CE
+           DBE2D48F 509A88B1 40CDE7D6 DED5E173
+
+   K[1] = 340E7848 83223B67 025AAAAB DDA5F1F2
+          5B6AF7ED 1575DE87 19E64326 D2BDF236
+
+   K[2] = 03DC0ED0 F4CD26BC 8B595F13 F5A4A55E
+          A8B063CB ED3D7325 6511662A 7963008D
+
+   K[3] = C954EF19 D0779A68 ED37D3FB 7DA5ADDC
+          4A9D0277 78EF765B C4731191 7EBB21B1
+
+   K[4] = 6D12BC47 D9363D19 1E3C696F 28F2DC02
+          F2137F37 64E4C18B 69CCFBF8 EF72B7E3
+
+   S    = 790DD7A1 066544EA 2829563C 3C39D781
+          25EF9645 EE2C05DD A5ECAD92 2511A4D1
+
+   KSI  = 0852F562 3B89DD57 AEB4781F E54DF14E
+          EAFBC135 0613763A 0D770AA6 57BA1A47
+
+   Then, the hash result is:
+
+   H    = 0852F562 3B89DD57 AEB4781F E54DF14E
+          EAFBC135 0613763A 0D770AA6 57BA1A47
+
+8.  Security Considerations
+
+   This entire document is about security considerations.
+
+   Current cryptographic resistance of GOST R 34.11-94 hash algorithm is
+   estimated as 2^128 operations of computations of step hash functions.
+   (There is a known method to reduce this estimate to 2^105 operations,
+   but it demands padding the colliding message with 1024 random bit
+   blocks each of 256-bit length; thus, it cannot be used in any
+   practical implementation).
+
+9.  Normative References
+
+   [GOST28147] "Cryptographic Protection for Data Processing System",
+               GOST 28147-89, Gosudarstvennyi Standard of USSR,
+               Government Committee of the USSR for Standards, 1989.
+               (In Russian)
+
+   [GOST3411]  "Information technology.  Cryptographic Data Security.
+               Hashing function.", GOST R 34.10-94, Gosudarstvennyi
+               Standard of Russian Federation, Government Committee of
+               the Russia for Standards, 1994. (In Russian)
+
+
+
+Dolmatov                      Informational                    [Page 16]
+
+RFC 5831                     GOST R 34.11-94                  March 2010
+
+
+10.  Contributors
+
+   Dmitry Kabelev
+   Cryptocom, Ltd.
+   14 Kedrova St., Bldg. 2
+   Moscow, 117218
+   Russian Federation
+
+
+   EMail: kdb@cryptocom.ru
+
+   Igor Ustinov
+   Cryptocom, Ltd.
+   14 Kedrova St., Bldg. 2
+   Moscow, 117218
+   Russian Federation
+
+   EMail: igus@cryptocom.ru
+
+
+   Sergey Vyshensky
+   Moscow State University
+   Leninskie gory, 1
+   Moscow, 119991
+   Russian Federation
+
+   EMail: svysh@pn.sinp.msu.ru
+
+Author's Address
+
+   Vasily Dolmatov, Ed.
+   Cryptocom, Ltd.
+   14 Kedrova St., Bldg. 2
+   Moscow, 117218
+   Russian Federation
+
+   EMail: dol@cryptocom.ru
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+Dolmatov                      Informational                    [Page 17]
+