Internal differential collision attacks on the reduced-round Grøstl-0 hash function

Abstract

We analyze the GrOstl-0 hash function, that is the version of GrOstl submitted to the SHA-3 competition. This paper extends Peyrin's internal differential strategy, that uses differential paths between the permutations P and Q of GrOstl-0 to construct distinguishers of the compression function. This results in collision attacks and semi-free-start collision attacks on the GrOstl-0 hash function and compression function with reduced rounds. Specifically, we show collision attacks on the GrOstl-0-256 hash function reduced to 5 and 6 out of 10 rounds with time complexities 248 and 2112 and on the GrOstl-0-512 hash function reduced to 6 out of 14 rounds with time complexity 2183. Furthermore, we demonstrate semi-free-start collision attacks on the GrOstl-0-256 compression function reduced to 8 rounds and the GrOstl-0-512 compression function reduced to 9 rounds. Finally, we show improved distinguishers for the GrOstl-0-256 permutations with reduced rounds.