From Wikipedia, the free encyclopedia  View original article
A cyclic redundancy check (CRC) is an errordetecting code commonly used in digital networks and storage devices to detect accidental changes to raw data. Blocks of data entering these systems get a short check value attached, based on the remainder of a polynomial division of their contents; on retrieval the calculation is repeated, and corrective action can be taken against presumed data corruption if the check values do not match.
CRCs are so called because the check (data verification) value is a redundancy (it expands the message without adding information) and the algorithm is based on cyclic codes. CRCs are popular because they are simple to implement in binary hardware, easy to analyze mathematically, and particularly good at detecting common errors caused by noise in transmission channels. Because the check value has a fixed length, the function that generates it is occasionally used as a hash function.
The CRC was invented by W. Wesley Peterson in 1961; the 32bit CRC function of Ethernet and many other standards is the work of several researchers and was published in 1975.
CRCs are based on the theory of cyclic errorcorrecting codes. The use of systematic cyclic codes, which encode messages by adding a fixedlength check value, for the purpose of error detection in communication networks, was first proposed by W. Wesley Peterson in 1961.^{[1]} Cyclic codes are not only simple to implement but have the benefit of being particularly well suited for the detection of burst errors, contiguous sequences of erroneous data symbols in messages. This is important because burst errors are common transmission errors in many communication channels, including magnetic and optical storage devices. Typically an nbit CRC applied to a data block of arbitrary length will detect any single error burst not longer than n bits and will detect a fraction 1 − 2^{−n} of all longer error bursts.
Specification of a CRC code requires definition of a socalled generator polynomial. This polynomial becomes the divisor in a polynomial long division, which takes the message as the dividend and in which the quotient is discarded and the remainder becomes the result. The important caveat is that the polynomial coefficients are calculated according to the arithmetic of a finite field, so the addition operation can always be performed bitwiseparallel (there is no carry between digits). The length of the remainder is always less than the length of the generator polynomial, which therefore determines how long the result can be.
In practice, all commonly used CRCs employ the Galois field of two elements, GF(2). The two elements are usually called 0 and 1, comfortably matching computer architecture.
A CRC is called an nbit CRC when its check value is n bits. For a given n, multiple CRCs are possible, each with a different polynomial. Such a polynomial has highest degree n, which means it has n + 1 terms. In other words, the polynomial has a length of n + 1; its encoding requires n + 1 bits. Note that most polynomial specifications either drop the MSB or LSB bit, since they are always 1. The CRC and associated polynomial typically have a name of the form CRCnXXX as in the table below.
The simplest errordetection system, the parity bit, is in fact a trivial 1bit CRC: it uses the generator polynomial x + 1 (two terms), and has the name CRC1.
A CRCenabled device calculates a short, fixedlength binary sequence, known as the check value or CRC, for each block of data to be sent or stored and appends it to the data, forming a codeword. When a codeword is received or read, the device either compares its check value with one freshly calculated from the data block, or equivalently, performs a CRC on the whole codeword and compares the resulting check value with an expected residue constant. If the check values do not match, then the block contains a data error. The device may take corrective action, such as rereading the block or requesting that it be sent again. Otherwise, the data is assumed to be errorfree (though, with some small probability, it may contain undetected errors; this is the fundamental nature of errorchecking).^{[2]}
CRCs are specifically designed to protect against common types of errors on communication channels, where they can provide quick and reasonable assurance of the integrity of messages delivered. However, they are not suitable for protecting against intentional alteration of data.
Firstly, as there is no authentication, an attacker can edit a message and recompute the CRC without the substitution being detected. When stored alongside the data, CRCs and cryptographic hash functions by themselves do not protect against intentional modification of data. Any application that requires protection against such attacks must use cryptographic authentication mechanisms, such as message authentication codes or digital signatures (which are commonly based on cryptographic hash functions).
Secondly, unlike cryptographic hash functions, CRC is an easily reversible function, which makes it unsuitable for use in digital signatures.^{[3]}
Thirdly, CRC is a linear function with a property that ; as a result, even if the CRC is encrypted with a stream cipher that uses XOR as its combining operation (or mode of block cipher which effectively turns it into a stream cipher, such as OFB or CFB), both the message and the associated CRC can be manipulated without knowledge of the encryption key; this was one of the wellknown design flaws of the Wired Equivalent Privacy (WEP) protocol.^{[4]}
To compute an nbit binary CRC, line the bits representing the input in a row, and position the (n + 1)bit pattern representing the CRC's divisor (called a "polynomial") underneath the lefthand end of the row.
In this example, we shall encode 14 bits of message with a 3bit CRC, with a polynomial x³+x+1. The polynomial is written in binary as the coefficients; a 3rd order polynomial has 4 coefficients (1x³+0x²+1x+1). In this case, the coefficients are 1,0, 1 and 1. The result of the calculation is 3 bits long.
Start with the message to be encoded:
11010011101100
This is first padded with zeroes corresponding to the bit length n of the CRC. Here is the first calculation for computing a 3bit CRC:
11010011101100 000 < input right padded by 3 bits 1011 < divisor (4 bits) = x³+x+1  01100011101100 000 < result
The algorithm acts on the bits directly above the divisor in each step. The result for that iteration is the bitwise XOR of the polynomial divisor with the bits above it. The bits not above the divisor are simply copied directly below for that step. The divisor is then shifted one bit to the right, and the process is repeated until the divisor reaches the righthand end of the input row. Here is the entire calculation:
11010011101100 000 < input right padded by 3 bits 1011 < divisor 01100011101100 000 < result (note the first four bits are the XOR with the divisor beneath, the rest of the bits are unchanged) 1011 < divisor ... 00111011101100 000 1011 00010111101100 000 1011 00000001101100 000 < note that the divisor moves over to align with the next 1 in the dividend (since quotient for that step was zero) 1011 (in other words, it doesn't necessarily move one bit per iteration) 00000000110100 000 1011 00000000011000 000 1011 00000000001110 000 1011 00000000000101 000 101 1  00000000000000 100 < remainder (3 bits). Division algorithm stops here as quotient is equal to zero.
Since the leftmost divisor bit zeroed every input bit it touched, when this process ends the only bits in the input row that can be nonzero are the n bits at the righthand end of the row. These n bits are the remainder of the division step, and will also be the value of the CRC function (unless the chosen CRC specification calls for some postprocessing).
The validity of a received message can easily be verified by performing the above calculation again, this time with the check value added instead of zeroes. The remainder should equal zero if there are no detectable errors.
11010011101100 100 < input with check value 1011 < divisor 01100011101100 100 < result 1011 < divisor ... 00111011101100 100 ...... 00000000001110 100 1011 00000000000101 100 101 1  0 < remainder
Mathematical analysis of this divisionlike process reveals how to select a divisor that guarantees good errordetection properties. In this analysis, the digits of the bit strings are taken as the coefficients of a polynomial in some variable x—coefficients that are elements of the finite field GF(2), instead of more familiar numbers. The set of binary polynomials is a mathematical ring.
The selection of generator polynomial is the most important part of implementing the CRC algorithm. The polynomial must be chosen to maximize the errordetecting capabilities while minimizing overall collision probabilities.
The most important attribute of the polynomial is its length (largest degree(exponent) +1 of any one term in the polynomial), because of its direct influence on the length of the computed check value.
The most commonly used polynomial lengths are:
A CRC is called an nbit CRC when its check value is nbits. For a given n, multiple CRC's are possible, each with a different polynomial. Such a polynomial has highest degree n, and hence n + 1 terms (the polynomial has a length of n + 1). The remainder has length n. The CRC has a name of the form CRCnXXX.
The design of the CRC polynomial depends on the maximum total length of the block to be protected (data + CRC bits), the desired error protection features, and the type of resources for implementing the CRC, as well as the desired performance. A common misconception is that the "best" CRC polynomials are derived from either irreducible polynomials or irreducible polynomials times the factor 1 + x, which adds to the code the ability to detect all errors affecting an odd number of bits.^{[5]} In reality, all the factors described above should enter into the selection of the polynomial and may lead to a reducible polynomial. However, choosing a reducible polynomial will result in a certain proportion of missed errors, due to the quotient ring having zero divisors.
The advantage of choosing a primitive polynomial as the generator for a CRC code is that the resulting code has maximal total block length in the sense that all 1bit errors within that block length have different remainders (also called syndromes) and therefore, since the remainder is a linear function of the block, the code can detect all 2bit errors within that block length. If r is the degree of the primitive generator polynomial, then the maximal total block length is , and the associated code is able to detect any singlebit or doublebit errors.^{[6]} We can improve this situation. If we use the generator polynomial , where is a primitive polynomial of degree , then the maximal total block length is , and the code is able to detect single, double, triple and any odd number of errors.
A polynomial that admits other factorizations may be chosen then so as to balance the maximal total blocklength with a desired error detection power. The BCH codes are a powerful class of such polynomials. They subsume the two examples above. Regardless of the reducibility properties of a generator polynomial of degree r, if it includes the "+1" term, the code will be able to detect error patterns that are confined to a window of r contiguous bits. These patterns are called "error bursts".
The concept of the CRC as an errordetecting code gets complicated when an implementer or standards committee uses it to design a practical system. Here are some of the complications:
These complications mean that there are three common ways to express a polynomial as an integer: the first two, which are mirror images in binary, are the constants found in code; the third is the number found in Koopman's papers. In each case, one term is omitted. So the polynomial may be transcribed as:
In the table below they are shown as:
Examples of CRC Representations  

Name  Normal  Reversed  Reversed reciprocal 
CRC4  0x3  0xC  0x9 
Numerous varieties of cyclic redundancy checks have been incorporated into technical standards. By no means does one algorithm, or one of each degree, suit every purpose; Koopman and Chakravarty recommend selecting a polynomial according to the application requirements and the expected distribution of message lengths.^{[7]} The number of distinct CRCs in use has confused developers, a situation which authors have sought to address.^{[5]} There are three polynomials reported for CRC12,^{[7]} sixteen conflicting definitions of CRC16, and six of CRC32.^{[8]}
The polynomials commonly applied are not the most efficient ones possible. Between 1993 and 2004, Koopman, Castagnoli and others surveyed the space of polynomials up to 16 bits,^{[7]} and of 24 and 32 bits,^{[9]}^{[10]} finding examples that have much better performance (in terms of Hamming distance for a given message size) than the polynomials of earlier protocols, and publishing the best of these with the aim of improving the error detection capacity of future standards.^{[10]} In particular, iSCSI and SCTP have adopted one of the findings of this research, the CRC32C (Castagnoli) polynomial.
The design of the 32bit polynomial most commonly used by standards bodies, CRC32IEEE, was the result of a joint effort for the Rome Laboratory and the Air Force Electronic Systems Division by Joseph Hammond, James Brown and ShyanShiang Liu of the Georgia Institute of Technology and Kenneth Brayer of the MITRE Corporation. The earliest known appearances of the 32bit polynomial were in their 1975 publications: Technical Report 2956 by Brayer for MITRE, published in January and released for public dissemination through DTIC in August,^{[11]} and Hammond, Brown and Liu's report for the Rome Laboratory, published in May.^{[12]} Both reports contained contributions from the other team. During December 1975, Brayer and Hammond presented their work in a paper at the IEEE National Telecommunications Conference: the IEEE CRC32 polynomial is the generating polynomial of a Hamming code and was selected for its error detection performance.^{[13]} Even so, the Castagnoli CRC32C polynomial used in iSCSI or SCTP matches its performance on messages from 58 bits to 131 kbits, and outperforms it in several size ranges including the two most common sizes of Internet packet.^{[10]} The ITUT G.hn standard also uses CRC32C to detect errors in the payload (although it uses CRC16CCITT for PHY headers).
The table below lists only the polynomials of the various algorithms in use. Variations of a particular protocol can impose preinversion, postinversion and reversed bit ordering as described above. For example, the CRC32 used in both Gzip and Bzip2 use the same polynomial, but Bzip2 employs reversed bit ordering, while Gzip does not.
CRCs in proprietary protocols might use a nontrivial initial value and final XOR for obfuscation but this does not add cryptographic strength to the algorithm. An unknown errordetecting code can be characterized as a CRC, and as such fully reverse engineered, from its output codewords.^{[14]}
See Polynomial representations of cyclic redundancy checks for the algebraic representations of the polynomials for the CRCs below.
Name  Uses  Polynomial representations  

Normal  Reversed  Reversed reciprocal  
CRC1  most hardware; also known as parity bit  0x1  0x1  0x1 
CRC4ITU  G.704  0x3  0xC  0x9 
CRC5EPC  Gen 2 RFID^{[15]}  0x09  0x12  0x14 
CRC5ITU  G.704  0x15  0x15  0x1A 
CRC5USB  USB token packets  0x05  0x14  0x12 
CRC6CDMA2000A  mobile networks^{[16]}  0x27  0x39  0x33 
CRC6CDMA2000B  mobile networks^{[16]}  0x07  0x38  0x23 
CRC6ITU  G.704  0x03  0x30  0x21 
CRC7  telecom systems, G.707, G.832, MMC, SD  0x09  0x48  0x44 
CRC7MVB  Train Communication Network, IEC 608705^{[17]}  0x65  0x53  0x72 
CRC8  0xD5  0xAB  0xEA^{[7]}  
CRC8CCITT  I.432.1; ATM HEC, ISDN HEC and cell delineation  0x07  0xE0  0x83 
CRC8Dallas/Maxim  1Wire bus  0x31  0x8C  0x98 
CRC8SAE J1850  AES3  0x1D  0xB8  0x8E 
CRC8WCDMA  mobile networks^{[16]}^{[18]}  0x9B  0xD9  0xCD^{[7]} 
CRC10  ATM; I.610  0x233  0x331  0x319 
CRC10CDMA2000  mobile networks^{[16]}  0x3D9  0x26F  0x3EC 
CRC11  FlexRay^{[19]}  0x385  0x50E  0x5C2 
CRC12  telecom systems^{[20]}^{[21]}  0x80F  0xF01  0xC07^{[7]} 
CRC12CDMA2000  mobile networks^{[16]}  0xF13  0xC8F  0xF89 
CRC13BBC  Time signal, Radio teleswitch^{[22]}  0x1CF5  0x15E7  0x1E7A 
CRC15CAN  0x4599  0x4CD1  0x62CC  
CRC15MPT1327  ^{[23]}  0x6815  0x540B  0x740A 
Chakravarty  optimal for payloads ≤64 bits^{[17]}  0x2F15  0xA8F4  0x978A 
CRC16ARINC  ACARS applications^{[24]}  0xA02B  0xD405  0xD015 
CRC16CCITT  X.25, V.41, HDLC FCS, XMODEM, Bluetooth, PACTOR, SD, many others; known as CRCCCITT  0x1021  0x8408  0x8810^{[7]} 
CRC16CDMA2000  mobile networks^{[16]}  0xC867  0xE613  0xE433 
CRC16DECT  cordless telephones^{[25]}  0x0589  0x91A0  0x82C4 
CRC16T10DIF  SCSI DIF  0x8BB7^{[26]}  0xEDD1  0xC5DB 
CRC16DNP  DNP, IEC 870, MBus  0x3D65  0xA6BC  0x9EB2 
CRC16IBM  Bisync, Modbus, USB, ANSI X3.28, SIA DC07, many others; also known as CRC16 and CRC16ANSI  0x8005  0xA001  0xC002 
Fletcher  Used in Adler32 A & B Checksums  Not a CRC; see Fletcher's checksum  
CRC17CAN  CAN FD^{[27]}  0x1685B  0x1B42D  0x1B42D 
CRC21CAN  CAN FD^{[27]}  0x102899  0x132281  0x18144C 
CRC24  FlexRay^{[19]}  0x5D6DCB  0xD3B6BA  0xAEB6E5 
CRC24Radix64  OpenPGP, RTCM104v3  0x864CFB  0xDF3261  0xC3267D 
CRC30  CDMA  0x2030B9C7  0x38E74301  0x30185CE3 
Adler32  Zlib  Not a CRC; see Adler32  
CRC32  HDLC, ANSI X3.66, ITUT V.42, Ethernet, Serial ATA, MPEG2, PKZIP, Gzip, Bzip2, PNG,^{[28]} many others  0x04C11DB7  0xEDB88320  0x82608EDB^{[10]} 
CRC32C (Castagnoli)  iSCSI, SCTP, G.hn payload, SSE4.2, Btrfs, ext4  0x1EDC6F41  0x82F63B78  0x8F6E37A0^{[10]} 
CRC32K (Koopman)  0x741B8CD7  0xEB31D82E  0xBA0DC66B^{[10]}  
CRC32Q  aviation; AIXM^{[29]}  0x814141AB  0xD5828281  0xC0A0A0D5 
CRC40GSM  GSM control channel^{[30]}^{[31]}  0x0004820009  0x9000412000  0x8002410004 
CRC64ECMA  ECMA182, XZ Utils  0x42F0E1EBA9EA3693  0xC96C5795D7870F42  0xA17870F5D4F51B49 
CRC64ISO  HDLC, SwissProt/TrEMBL; considered weak for hashing^{[32]}  0x000000000000001B  0xD800000000000000  0x800000000000000D 
