Groestl

1 The algorithm

• Author(s): Praveen Gauravaram, Lars R. Knudsen, Krystian Matusiewicz, Florian Mendel, Christian Rechberger, Martin Schläffer, Søren S. Thomsen
• Website: http://www.groestl.info
• NIST submission package:
  • round 1/2: Grostl_Round2.zip (old version: Grostl.zip)

Praveen Gauravaram, Lars R. Knudsen, Krystian Matusiewicz, Florian Mendel, Christian Rechberger, Martin Schläffer, Søren S. Thomsen - Grøstl -- a SHA-3 candidate

,2008

http://www.groestl.info/Groestl.pdf
Bibtex

Author : Praveen Gauravaram, Lars R. Knudsen, Krystian Matusiewicz, Florian Mendel, Christian Rechberger, Martin Schläffer, Søren S. Thomsen
Title : Grøstl -- a SHA-3 candidate
In : -
Address :
Date : 2008

Praveen Gauravaram, Lars R. Knudsen, Krystian Matusiewicz, Florian Mendel, Christian Rechberger, Martin Schläffer, Søren S. Thomsen - Grøstl Addendum

,2009

http://groestl.info/Groestl-addendum.pdf
Bibtex

Author : Praveen Gauravaram, Lars R. Knudsen, Krystian Matusiewicz, Florian Mendel, Christian Rechberger, Martin Schläffer, Søren S. Thomsen
Title : Grøstl Addendum
In : -
Address :
Date : 2009

2 Cryptanalysis

We distinguish between two cases: results on the complete hash function, and results on underlying building blocks.

A description of the tables is given here.

Recommended security parameter: 10 rounds (n=224,256); 14 rounds (n=384,512)

2.1 Hash function

Here we list results on the hash function according to the NIST requirements. The only allowed modification is to change the security parameter.

Type of Analysis	Hash Size (n)	Parameters	Compression Function Calls	Memory Requirements	Reference
collision	224,256	4 rounds	264	264	Mendel,Rechberger,Schläffer,Thomsen
collision	224,256	3 rounds	264	-	Mendel,Rechberger,Schläffer,Thomsen
collision	384,512	5 rounds	2176	264	Mendel,Rechberger,Schläffer,Thomsen
collision	384,512	4 rounds	264	264	Mendel,Rechberger,Schläffer,Thomsen

2.2 Building blocks

Here we list results on underlying building blocks, and the hash function modified by other means than the security parameter.

Note that these results assume more direct control or access over some internal variables (aka. free-start, pseudo, compression function, block cipher, or permutation attacks).

Type of Analysis	Hash Function Part	Hash Size (n)	Parameters/Variants	Compression Function Calls	Memory Requirements	Reference
distinguisher	compression function	256	10 rounds	2192	264	Peyrin
distinguisher	compression function	256	9 rounds	280	264	Peyrin
distinguisher	compression function	512	11 rounds	2640	264	Peyrin
semi-free-start collision	compression function	256	7 rounds	2120	264	Gilbert,Peyrin
distinguisher	compression function	256	8 rounds	2112	264	Gilbert,Peyrin
distinguisher	permutation	256	8 rounds	2112	264	Gilbert,Peyrin
semi-free-start collision	compression function	256	7 rounds	2120	264	Mendel,Rechberger,Schläffer,Thomsen
semi-free-start collision	compression function	384,512	7 rounds	2152	264	Mendel,Rechberger,Schläffer,Thomsen
semi-free-start collision	compression function	224,256	6 rounds	264	264	Mendel,Peyrin,Rechberger,Schläffer
distinguisher	output transformation	224,256	7 rounds	256	-	Mendel,Peyrin,Rechberger,Schläffer
distinguisher	permutation	224,256	7 rounds	255	-	Mendel,Peyrin,Rechberger,Schläffer
semi-free-start collision	compression function	256	6 rounds	2120	264	Mendel,Rechberger,Schläffer,Thomsen
semi-free-start collision	compression function	224,256	5 rounds	264	-	Mendel,Rechberger,Schläffer,Thomsen
observation	hash	all				Kelsey
observation	block cipher	all				Barreto
free-start collision	compression function	all	any	22n/3	22n/3	submission document
pseudo-preimage	compression function	all	any	2n	-	submission document

Thomas Peyrin - Improved Differential Attacks for ECHO and Grostl

,2010

Bibtex

Author : Thomas Peyrin
Title : Improved Differential Attacks for ECHO and Grostl
In : -
Address :
Date : 2010

Henri Gilbert, Thomas Peyrin - Super-Sbox Cryptanalysis: Improved Attacks for AES-like permutations

FSE ,2010

http://eprint.iacr.org/2009/531.pdf
Bibtex

Author : Henri Gilbert, Thomas Peyrin
Title : Super-Sbox Cryptanalysis: Improved Attacks for AES-like permutations
In : FSE -
Address :
Date : 2010

Florian Mendel, Christian Rechberger, Martin Schläffer, Søren S. Thomsen - Rebound Attacks on the Reduced Grøstl Hash Function

CT-RSA 5985:350-365,2010

http://online.tu-graz.ac.at/tug_online/voe_main2.getVollText?pDocumentNr=128007&pCurrPk=47053
Bibtex

Author : Florian Mendel, Christian Rechberger, Martin Schläffer, Søren S. Thomsen
Title : Rebound Attacks on the Reduced Grøstl Hash Function
In : CT-RSA -
Address :
Date : 2010

Florian Mendel, Thomas Peyrin, Christian Rechberger, Martin Schläffer - Improved Cryptanalysis of the Reduced Grøstl

Compression Function, ECHO Permutation and AES Block Cipher

SAC 5867:16-35,2009

http://online.tu-graz.ac.at/tug_online/voe_main2.getVollText?pDocumentNr=124407&pCurrPk=44420
Bibtex

Author : Florian Mendel, Thomas Peyrin, Christian

Rechberger, Martin Schläffer
Title : Improved Cryptanalysis of the Reduced Grøstl

Compression Function, ECHO Permutation and AES Block Cipher
In : SAC -
Address :
Date : 2009

Florian Mendel, Christian Rechberger, Martin Schläffer, Søren S. Thomsen - The Rebound Attack: Cryptanalysis of Reduced Whirlpool and Grøstl

FSE 5665:260-276,2009

http://online.tu-graz.ac.at/tug_online/voe_main2.getVollText?pDocumentNr=124409&pCurrPk=40943
Bibtex

Author : Florian Mendel, Christian Rechberger, Martin Schläffer, Søren S. Thomsen
Title : The Rebound Attack: Cryptanalysis of Reduced Whirlpool and Grøstl
In : FSE -
Address :
Date : 2009

John Kelsey - Some notes on Grøstl

,2009

http://ehash.iaik.tugraz.at/uploads/d/d0/Grostl-comment-april28.pdf
Bibtex

Author : John Kelsey
Title : Some notes on Grøstl
In : -
Address :
Date : 2009

Paulo S. L. M. Barreto - An observation on Grøstl

,2008

http://www.larc.usp.br/~pbarreto/Grizzly.pdf
Bibtex

Author : Paulo S. L. M. Barreto
Title : An observation on Grøstl
In : -
Address :
Date : 2008