Grøstl

Grøstl is a cryptographic hash function that was submitted to the NIST hash function competition by Praveen Gauravaram, Lars Knudsen, Krystian Matusiewicz, Florian Mendel, Christian Rechberger, Martin Schläffer and Søren S. Thomsen, and it was chosen as one of the five finalists. Its name is a multilingual pun on an Austrian dish that resembles hash. Grøstl reuses the S-box of the AES block cipher inside a custom construction. Like the MD5 and SHA families it splits the input into blocks and updates a chaining value block by block, but it keeps an internal state at least twice the size of the final digest, 512 or 1024 bits, and truncates it only at the end. Its compression function is built from a pair of permutations P and Q that closely follow Rijndael, working on byte arrays of 8 by 8 or 8 by 16 rather than 4 by 4, with 10 rounds recommended for the 512 bit version and 14 for the 1024 bit version. Its authors claim speeds of up to 21.4 cycles per byte on an Intel Core 2 Duo.