Rebound attacks on the reduced grøstl hash function

Authors:
Florian Mendel;Christian Rechberger;Martin Schläffer;Søren S. Thomsen
Affiliations:
Institute for Applied Information Processing and Communications (IAIK), Graz University of Technology, Graz, Austria;Dept. of Electrical Engineering ESAT/COSIC, K.U. Leuven, and Interdisciplinary Institute for BroadBand Technology (IBBT), Heverlee, Belgium;Institute for Applied Information Processing and Communications (IAIK), Graz University of Technology, Graz, Austria;Department of Mathematics, Technical University of Denmark, Lyngby, Denmark
Venue:
CT-RSA'10 Proceedings of the 2010 international conference on Topics in Cryptology
Year:
2010

Citing 9
Cited 10

Chosen-Prefix Collisions for MD5 and Colliding X.509 Certificates for Different Identities

EUROCRYPT '07 Proceedings of the 26th annual international conference on Advances in Cryptology
The Rebound Attack: Cryptanalysis of Reduced Whirlpool and Grøstl

Fast Software Encryption
Cryptanalysis of Tweaked Versions of SMASH and Reparation

Selected Areas in Cryptography
Improved Cryptanalysis of the Reduced Grøstl Compression Function, ECHO Permutation and AES Block Cipher

Selected Areas in Cryptography
Rebound Distinguishers: Results on the Full Whirlpool Compression Function

ASIACRYPT '09 Proceedings of the 15th International Conference on the Theory and Application of Cryptology and Information Security: Advances in Cryptology
Finding SHA-1 characteristics: general results and applications

ASIACRYPT'06 Proceedings of the 12th international conference on Theory and Application of Cryptology and Information Security
Finding collisions in the full SHA-1

CRYPTO'05 Proceedings of the 25th annual international conference on Advances in Cryptology
How to break MD5 and other hash functions

EUROCRYPT'05 Proceedings of the 24th annual international conference on Theory and Applications of Cryptographic Techniques
Understanding two-round differentials in AES

SCN'06 Proceedings of the 5th international conference on Security and Cryptography for Networks

Super-Sbox cryptanalysis: improved attacks for AES-like permutations

FSE'10 Proceedings of the 17th international conference on Fast software encryption
Improved differential attacks for ECHO and Grøstl

CRYPTO'10 Proceedings of the 30th annual conference on Advances in cryptology
Known-key attacks on Rijndael with large blocks and strengthening shiftrow parameter

IWSEC'10 Proceedings of the 5th international conference on Advances in information and computer security
Improved collision attacks on the reduced-round Grøstl hash function

ISC'10 Proceedings of the 13th international conference on Information security
Subspace distinguisher for 5/8 rounds of the ECHO-256 hash function

SAC'10 Proceedings of the 17th international conference on Selected areas in cryptography
Rebound attack on JH42

ASIACRYPT'11 Proceedings of the 17th international conference on The Theory and Application of Cryptology and Information Security
Improved rebound attack on the finalist grøstl

FSE'12 Proceedings of the 19th international conference on Fast Software Encryption
Bicliques for permutations: collision and preimage attacks in stronger settings

ASIACRYPT'12 Proceedings of the 18th international conference on The Theory and Application of Cryptology and Information Security
Investigating fundamental security requirements on whirlpool: improved preimage and collision attacks

ASIACRYPT'12 Proceedings of the 18th international conference on The Theory and Application of Cryptology and Information Security
Internal differential collision attacks on the reduced-round GrØstl-0 hash function

Designs, Codes and Cryptography

Quantified Score

Hi-index	0.00

Visualization

Abstract

Grøstl is one of 14 second round candidates of the NIST SHA-3 competition. Cryptanalytic results on the wide-pipe compression function of Grøstl-256 have already been published. However, little is known about the hash function, arguably a much more interesting cryptanalytic setting. Also, Grøstl-512 has not been analyzed yet. In this paper, we show the first cryptanalytic attacks on reduced-round versions of the Grøstl hash functions. These results are obtained by several extensions of the rebound attack. We present a collision attack on 4/10 rounds of the Grøstl-256 hash function and 5/14 rounds of the Grøstl-512 hash functions. Additionally, we give the best collision attack for reduced-round (7/10 and 7/14) versions of the compression function of Grøstl-256 and Grøstl-512.