Unkeyed cryptographic

Grøstl

A SHA-3 competition finalist by Praveen Gauravaram, Lars Knudsen, Krystian Matusiewicz, Florian Mendel, Christian Rechberger, Martin Schläffer, and Søren Thomsen (2008). Built on two AES-like permutations in a wide-pipe Merkle-Damgård construction. Strong cryptographic margin, but lost the final round to Keccak.

At a glance

Wide-pipe construction

Grøstl maintains an internal state twice the size of its output. Each message block is fed through two parallel permutations (P and Q), which are then combined and truncated to produce the next chaining state. The output is the truncation of the final state. The wide pipe defeats generic Joux-style multi-collision attacks and gives a comfortable security margin.

AES heritage

Both P and Q permutations use AES-like rounds: a custom S-box, byte shifting, an MDS matrix, and round constants. CPUs with AES-NI can accelerate Grøstl using the AES round-encryption instruction with some adaptation , Grøstl was among the fastest SHA-3 candidates on AES-NI hardware.

Why Keccak won

NIST’s rationale for selecting Keccak over Grøstl prioritized structural diversity from SHA-2 (sponge vs Merkle-Damgård) and side-channel resistance (Keccak has fewer table lookups). Grøstl remained an excellent algorithm; just not the one selected.

Where it shows up

• Academic literature on SHA-3 candidates , standard comparison reference.
• Some research and educational libraries.
• Niche applications in storage where designers wanted an AES-NI-friendly alternative to SHA-256.

References

• Grøstl home page (full specification)
• SHA3-256 · Skein · Whirlpool