Grøstl
| General | |
|---|---|
| Designers | Praveen Gauravaram, Lars Knudsen, Krystian Matusiewicz, Florian Mendel, Christian Rechberger, Martin Schläffer, and Søren S. Thomsen |
| Related to | AES |
| Certification | SHA-3 finalist |
| Detail | |
| Digest sizes | arbitrary (from 8 to 512 bits in 8-bit steps) |
| Rounds | 10 (digest size 8-256) or 14 (digest size 264-512) |
| Speed | 21.4 cpb on Core 2 for 224/256 bit digest; 30.1 cpb for 384/512 bit digest. |
| Best public cryptanalysis | |
| Collision attack on 5 rounds | |
Grøstl is a cryptographic hash function submitted to the NIST hash function competition by Praveen Gauravaram, Lars Knudsen, Krystian Matusiewicz, Florian Mendel, Christian Rechberger, Martin Schläffer, and Søren S. Thomsen. Grøstl was chosen as one of the five finalists of the competition. It uses the same S-box as AES in a custom construction. The authors claim speeds of up to 21.4 cycles per byte on an Intel Core 2 Duo.
According to the submission document, the name "Grøstl" is a multilingual play-on-words, referring to an Austrian dish that is very similar to hash (food).
Like other hash functions in the MD5/SHA family, Grøstl divides the input into blocks and iteratively computes hi = f(hi−1, mi). However, Grøstl maintains a hash state at least twice the size of the final output (512 or 1024 bits), which is only truncated at the end of hash computation.
The compression function f is based on a pair of 256- or 512-bit permutation functions P and Q, and is defined as:
The permutation functions P and Q are heavily based on the Rijndael (AES) block cipher, but operate on 8×8 or 8×16 arrays of bytes, rather than 4×4. Like AES, each round consists of four operations:
Unlike Rijndael, all rounds are identical and there is no final AddRoundKey operation. 10 rounds are recommended for the 512-bit permutation, and 14 rounds for the 1024-bit version.
The final double-width hash receives a final output transformation of
and is then truncated to the desired width. This is equivalent to applying a final iteration of the compression function using an all-zero message block m, followed by a (cryptographically insignificant) exclusive-or with the fixed constant Q(0).
Hash values of empty string.
Even a small change in the message will (with overwhelming probability) result in a mostly different hash, due to the avalanche effect. For example, adding a period to the end of the sentence:
...
Wikipedia