Ideguchi, Kota3; Tischhauser, Elmar Wolfgang1; Preneel, Bart4
1 Department of Applied Mathematics and Computer Science, Technical University of Denmark2 Cryptology, Department of Applied Mathematics and Computer Science, Technical University of Denmark3 Hitachi Ltd.4 Katholieke Universiteit
We analyze the Grøstl-0 hash function, that is the version of Grøstl submitted to the SHA-3 competition. This paper extends Peyrin’s internal differential strategy, that uses differential paths between the permutations P and Q of Grøstl-0 to construct distinguishers of the compression function. This results in collision attacks and semi-free-start collision attacks on the Grøstl-0 hash function and compression function with reduced rounds. Specifically, we show collision attacks on the Grøstl-0-256 hash function reduced to 5 and 6 out of 10 rounds with time complexities 248 and 2112 and on the Grøstl-0-512 hash function reduced to 6 out of 14 rounds with time complexity 2183. Furthermore, we demonstrate semi-free-start collision attacks on the Grøstl-0-256 compression function reduced to 8 rounds and the Grøstl-0-512 compression function reduced to 9 rounds. Finally, we show improved distinguishers for the Grøstl-0-256 permutations with reduced rounds.
Designs, Codes and Cryptography, 2014, Vol 70, Issue 3, p. 251-271