Groestl - Revision history

Fmendel at 09:12, 1 August 2013

2013-08-01T09:12:02Z

Mlauridsen: Added attacks by [Jean,Naya-Plasencia,Peyrin] + [Wu,Feng,Wu,Guo,Dong,Zou] + [Khovratovich] + [Emami,Guaravaram,Pieprzyk,Steinfeld], including references

2013-02-14T12:34:46Z

Added attacks by [Jean,Naya-Plasencia,Peyrin] + [Wu,Feng,Wu,Guo,Dong,Zou] + [Khovratovich] + [Emami,Guaravaram,Pieprzyk,Steinfeld], including references

GVanAssche at 09:43, 31 August 2011

2011-08-31T09:43:37Z

Mschlaeffer: references updated

2011-04-22T08:04:57Z

references updated

Mschlaeffer at 08:33, 4 April 2011

2011-04-04T08:33:40Z

Mschlaeffer at 08:32, 4 April 2011

2011-04-04T08:32:34Z

Mschlaeffer at 13:11, 28 March 2011

2011-03-28T13:11:36Z

Mschlaeffer at 13:09, 28 March 2011

2011-03-28T13:09:32Z

Mschlaeffer at 09:26, 21 March 2011

2011-03-21T09:26:21Z

Mschlaeffer at 08:40, 21 March 2011

2011-03-21T08:40:31Z

Show changes

@@ Line 126: / Line 126: @@
 | distinguisher  || permutation || 256 || 10 rounds || 2<sup>509</sup> || || [http://fse2011.mat.dtu.dk/slides/Higher-order%20differential%20properties%20of%20Keccak%20and%20Luffa.pdf Boura,Canteaut,DeCannière]
 |-
-| semi-free-start collision || compression function || 256 || 6 rounds || 2<sup>112</sup> || 2<sup>64</sup> || [http://groestl.info/groestl-analysis.pdf Schläffer]
+| semi-free-start collision || compression function || 256 || 6 rounds || 2<sup>120</sup> || 2<sup>64</sup> || [http://groestl.info/groestl-analysis.pdf Schläffer]
 |-
 | semi-free-start collision || compression function || 384,512 || 6 rounds || 2<sup>180</sup> || 2<sup>64</sup> || [http://groestl.info/groestl-analysis.pdf Schläffer]

@@ Line 71: / Line 71: @@
 |- style="background:#efefef;"
 | Type of Analysis || Hash Function Part || Hash Size (n) || Parameters/Variants || Compression Function Calls || Memory Requirements ||   Reference
 |-
 | distinguisher  || permutation || 256 || 10 rounds || 2<sup>509</sup> || || [http://fse2011.mat.dtu.dk/slides/Higher-order%20differential%20properties%20of%20Keccak%20and%20Luffa.pdf Boura,Canteaut,DeCannière]
@@ Line 142: / Line 194: @@
 |}
 <bibtex>

@@ Line 71: / Line 71: @@
 |- style="background:#efefef;"
 | Type of Analysis || Hash Function Part || Hash Size (n) || Parameters/Variants || Compression Function Calls || Memory Requirements ||   Reference
 |-
 | semi-free-start collision || compression function || 256 || 6 rounds || 2<sup>112</sup> || 2<sup>64</sup> || [http://groestl.info/groestl-analysis.pdf Schläffer]
@@ Line 140: / Line 142: @@
 |}
 <bibtex>

@@ Line 145: / Line 145: @@
      author = {Martin Schläffer},
      title = {Updated Differential Analysis of Grøstl},
-     howpublished = {Available online},
+     howpublished = {Grøstl website},
-     year = {2010},
+     month = {January},
-     note = {\url{http://eprint.iacr.org/}},
+     year = {2011},
      url = {http://groestl.info/groestl-analysis.pdf},
      abstract = {Grøstl is a SHA-3 finalist with clear proofs against a large class of differential attacks, similar to those of MD6. Furthermore, in this note we provide an update also regarding more advanced types of differential attacks that have been developed in recent years. We apply the rebound attacks on the initial submission to the tweaked version of Grøstl. We have analyzed the round-reduced hash function and compression function of Grøstl-256 (10 rounds) and Grøstl-512 (14 rounds). For both versions, we get collisions for 3 rounds of the hash function and collisions for 6 rounds of the compression function. We hope that our own efforts on improving the cryptanalysis will continue to motivate and accelerate external cryptanalysis.},
@@ Line 159: / Line 159: @@
      howpublished = {Cryptology ePrint Archive, Report 2010/607},
      year = {2010},
      url = {http://eprint.iacr.org/2010/607.pdf},
      abstract = {Rebound attacks are a state-of-the-art analysis method for hash functions. These cryptanalysis methods are based on a well chosen differential path and have been applied to several hash functions from the SHA-3 competition, providing the best known analysis in these cases. In this paper we study rebound attacks in detail and find for a great number of cases, that complexities of existing attacks can be improved. This is done by determining problems that adapt optimally to the cryptanalytic situation, and by using better algorithms to follow the differential path. These improvements are essentially based on merging big lists in a more efficient way, as well as on new ideas on how to reduce the complexities. As a result, we introduce general purpose new algorithms for enabling further rebound analysis to be as performant as possible. We illustrate our new algorithms for real hash functions and demonstrate how to reduce the complexities of the best known analysis on five hash functions: JH, Grøstl, ECHO, Luffa and Lane (the first four are round two SHA-3 candidates).},
@@ Line 166: / Line 165: @@
 <bibtex>
-@misc{groestlechoSLWSO10,
+@inproceedings{groestlechoSLWSO10,
    author = {Yu Sasaki and Yang Li and Lei Wang and Kazuo Sakiyama and Kazuo Ohta},
-   title = {New Non-Ideal Properties of AES-Based Permutations: Applications to ECHO and Grøstl
+   title = {New Non-Ideal Properties of AES-Based Permutations: Applications to ECHO and Grøstl},
-},
+  booktitle = {ASIACRYPT},
-   howpublished = {Second SHA-3 Candidate Conference},
+  year      = {2010},
-   year = {2010},
+   pages     = {38-55},
    url = {http://csrc.nist.gov/groups/ST/hash/sha-3/Round2/Aug2010/documents/papers/SASAKI_ECHOanalysisFinal.pdf},
    abstract = {In this paper, we present non-full-active Super-Sbox analysis which can detect non-ideal
@@ Line 188: / Line 190: @@
 <bibtex>
-@misc{ITP10,
+@inproceedings{ITP10,
      author = {Kota Ideguchi and Elmar Tischhauser and Bart Preneel},
      title = {Improved Collision Attacks on the Reduced-Round Grøstl Hash Function},
      howpublished = {Cryptology ePrint Archive, Report 2010/375},
-    year = {2010},
+  booktitle = {ISC},
-     note = {\url{http://eprint.iacr.org/}},
+  year      = {2010},
      url = {http://eprint.iacr.org/2010/375.pdf},
      abstract = {We analyze the Gr{\o}stl hash function, which is a 2nd-round candidate of the SHA-3 competition. Using the start-from-the-middle variant of the rebound technique, we show collision attacks on the Gr{\o}stl-256 hash function reduced to 5 and 6 out of 10 rounds with time complexities $2^{48}$ and $2^{112}$, respectively. Furthermore, we demonstrate semi-free-start collision attacks on the Gr{\o}stl-224 and -256 hash functions reduced to 7 rounds and the Gr{\o}stl-224 and -256 compression functions reduced to 8 rounds. Our attacks are based on differential paths between the two permutations $P$ and $Q$ of Gr{\o}stl, a strategy introduced by Peyrin to construct distinguishers for the compression function. In this paper, we extend this approach to construct collision and semi-free-start collision attacks for both the hash and the compression function. Finally, we present improved distinguishers for reduced-round versions of the Gr{\o}stl-224 and -256 permutations.},
@@ Line 200: / Line 206: @@
 <bibtex>
-@misc{Pey10,
+@inproceedings{Pey10,
      author = {Thomas Peyrin},
      title = {Improved Differential Attacks for ECHO and Grostl},
-    howpublished = {Cryptology ePrint Archive, Report 2010/223},
+  booktitle = {CRYPTO},
-    year = {2010},
+  year      = {2010},
-     note = {\url{http://eprint.iacr.org/}},
+  pages     = {370-392},
      url = {http://eprint.iacr.org/2010/223.pdf},
      abstract = {We present improved cryptanalysis of two second-round SHA-3 candidates: the AES-based hash functions ECHO and Grostl. We explain methods for building better differential trails for ECHO by increasing the granularity of the truncated differential paths previously considered. In the case of Grostl, we describe a new technique, the internal differential attack, which shows that when using parallel computations designers should also consider the differential security between the parallel branches. Then, we exploit the recently introduced start-from-the-middle or Super-Sbox attacks, that proved to be very efficient when attacking AES-like permutations, to achieve a very efficient utilization of the available freedom degrees. Finally, we obtain the best known attacks so far for both ECHO and Grostl. In particular, we are able to mount a distinguishing attack for the full Grostl-256 compression function.},
@@ Line 215: / Line 224: @@
    author    = {Henri Gilbert and Thomas Peyrin},
    title     = {Super-Sbox Cryptanalysis: Improved Attacks for AES-like permutations},
    booktitle  = {FSE},
    year       = {2010},
    series     = {LNCS},
    publisher  = {Springer},
-   note = {To appear}
+   pages     = {365-383},
    abstract = {In this paper, we improve the recent rebound and start-from-the-middle attacks on AES-like permutations. Our new cryptanalysis technique uses the fact that one can view two rounds of such permutations as a layer of big Sboxes preceded and followed by simple affine transformations. The big Sboxes encountered in this alternative representation are named Super-Sboxes. We apply this method to two second-round SHA-3 candidates Grostl and ECHO, and obtain improvements over the previous cryptanalysis results for these two schemes. Moreover, we improve the best distinguisher for the AES block cipher in the known-key setting, reaching 8 rounds for the 128-bit version.}
 </bibtex>
@@ Line 311: / Line 321: @@
    title     = {Some notes on Grøstl},
    url        = {http://ehash.iaik.tugraz.at/uploads/d/d0/Grostl-comment-april28.pdf},
-   howpublished = {Available online},
+   howpublished = {NIST hash function mailing list},
    year      = {2009},
    abstract  = {These are some quick notes on some properties and
@@ Line 326: / Line 337: @@
    title     = {An observation on Grøstl},
    url        = {http://www.larc.usp.br/~pbarreto/Grizzly.pdf},
-   howpublished = {Available online},
+   howpublished = {NIST hash function mailing list},
    year      = {2008},
    abstract  = {An alternative view of the Groestl SHA-3 submission is

@@ Line 4: / Line 4: @@
 * Website: [http://www.groestl.info http://www.groestl.info]
 * NIST submission package:
-** round 3: [http://csrc.nist.gov/groups/ST/hash/sha-3/Round3/documents/Groestl_FinalRnd.zip Groestl_FinalRnd.zip]
+** Round 3: [http://csrc.nist.gov/groups/ST/hash/sha-3/Round3/documents/Groestl_FinalRnd.zip Groestl_FinalRnd.zip]
-** round 1/2: [http://csrc.nist.gov/groups/ST/hash/sha-3/Round2/documents/Grostl_Round2.zip Grostl_Round2.zip] (old version: [http://csrc.nist.gov/groups/ST/hash/sha-3/Round1/documents/Grostl.zip Grostl.zip])
+** Round 1/2: [http://csrc.nist.gov/groups/ST/hash/sha-3/Round2/documents/Grostl_Round2.zip Grostl_Round2.zip] (old version: [http://csrc.nist.gov/groups/ST/hash/sha-3/Round1/documents/Grostl.zip Grostl.zip])
@@ Line 23: / Line 23: @@
    title     = {Grøstl Addendum},
    url        = {http://groestl.info/Groestl-addendum.pdf},
-   howpublished = {Available online},
+   howpublished = {Submission to NIST (Round 2)},
    year      = {2009},
+}
@@ Line 37: / Line 37: @@
+}
 </bibtex>
 == Cryptanalysis ==

@@ Line 77: / Line 77: @@
 | semi-free-start collision || compression function || 384,512 || 6 rounds || 2<sup>180</sup> || 2<sup>64</sup> || [http://groestl.info/groestl-analysis.pdf Schläffer]
 |-
-| collision || hash function || 224,256 || 5 rounds (Round 1) || 2<sup>48</sup> || 2<sup>32</sup> || [http://eprint.iacr.org/2010/375.pdf Ideguchi,Tischhauser,Preneel]
+| collision || hash function || 224,256 || 5 rounds (Round 1/2) || 2<sup>48</sup> || 2<sup>32</sup> || [http://eprint.iacr.org/2010/375.pdf Ideguchi,Tischhauser,Preneel]
 |-
-| collision || hash function || 256 || 6 rounds (Round 1) || 2<sup>112</sup> || 2<sup>32</sup> || [http://eprint.iacr.org/2010/375.pdf Ideguchi,Tischhauser,Preneel]
+| collision || hash function || 256 || 6 rounds (Round 1/2) || 2<sup>112</sup> || 2<sup>32</sup> || [http://eprint.iacr.org/2010/375.pdf Ideguchi,Tischhauser,Preneel]
 |-
-| collision || hash function || 224,256 || 4 rounds (Round 1) || 2<sup>64</sup> || 2<sup>64</sup> || [http://online.tu-graz.ac.at/tug_online/voe_main2.getVollText?pDocumentNr=128007&pCurrPk=47053 Mendel,Rechberger,Schläffer,Thomsen]
+| collision || hash function || 224,256 || 4 rounds (Round 1/2) || 2<sup>64</sup> || 2<sup>64</sup> || [http://online.tu-graz.ac.at/tug_online/voe_main2.getVollText?pDocumentNr=128007&pCurrPk=47053 Mendel,Rechberger,Schläffer,Thomsen]
 |-
-| collision || hash function || 224,256 || 3 rounds (Round 1) || 2<sup>64</sup> || - || [http://online.tu-graz.ac.at/tug_online/voe_main2.getVollText?pDocumentNr=128007&pCurrPk=47053 Mendel,Rechberger,Schläffer,Thomsen]
+| collision || hash function || 224,256 || 3 rounds (Round 1/2) || 2<sup>64</sup> || - || [http://online.tu-graz.ac.at/tug_online/voe_main2.getVollText?pDocumentNr=128007&pCurrPk=47053 Mendel,Rechberger,Schläffer,Thomsen]
 |-
-| collision || hash function || 384,512 || 5 rounds (Round 1) || 2<sup>176</sup> || 2<sup>64</sup> || [http://online.tu-graz.ac.at/tug_online/voe_main2.getVollText?pDocumentNr=128007&pCurrPk=47053 Mendel,Rechberger,Schläffer,Thomsen]
+| collision || hash function || 384,512 || 5 rounds (Round 1/2) || 2<sup>176</sup> || 2<sup>64</sup> || [http://online.tu-graz.ac.at/tug_online/voe_main2.getVollText?pDocumentNr=128007&pCurrPk=47053 Mendel,Rechberger,Schläffer,Thomsen]
 |-
-| collision || hash function || 384,512 || 4 rounds (Round 1) || 2<sup>64</sup> || 2<sup>64</sup> || [http://online.tu-graz.ac.at/tug_online/voe_main2.getVollText?pDocumentNr=128007&pCurrPk=47053 Mendel,Rechberger,Schläffer,Thomsen]
+| collision || hash function || 384,512 || 4 rounds (Round 1/2) || 2<sup>64</sup> || 2<sup>64</sup> || [http://online.tu-graz.ac.at/tug_online/voe_main2.getVollText?pDocumentNr=128007&pCurrPk=47053 Mendel,Rechberger,Schläffer,Thomsen]
 |-
-| distinguisher || compression function || 256 || 10 rounds (Round 1) || 2<sup>175</sup> || 2<sup>64</sup> || [http://eprint.iacr.org/2010/607.pdf Naya-Plasencia]
+| distinguisher || compression function || 256 || 10 rounds (Round 1/2) || 2<sup>175</sup> || 2<sup>64</sup> || [http://eprint.iacr.org/2010/607.pdf Naya-Plasencia]
 |-
-| distinguisher || compression function || 512 || 11 rounds (Round 1) || 2<sup>630</sup> || 2<sup>64</sup> || [http://eprint.iacr.org/2010/607.pdf Naya-Plasencia]
+| distinguisher || compression function || 512 || 11 rounds (Round 1/2) || 2<sup>630</sup> || 2<sup>64</sup> || [http://eprint.iacr.org/2010/607.pdf Naya-Plasencia]
 |-
 | distinguisher || permutation || 256 || 8 rounds || 2<sup>48</sup> || 2<sup>8</sup> || [http://csrc.nist.gov/groups/ST/hash/sha-3/Round2/Aug2010/documents/papers/SASAKI_ECHOanalysisFinal.pdf Sasaki,Li,Wang,Sakiyama,Ohta]
 |-
-| semi-free-start collision || compression function || 512 || 7 rounds (Round 1) || 2<sup>152</sup> || 2<sup>56</sup> || [http://csrc.nist.gov/groups/ST/hash/sha-3/Round2/Aug2010/documents/papers/SASAKI_ECHOanalysisFinal.pdf Sasaki,Li,Wang,Sakiyama,Ohta]
+| semi-free-start collision || compression function || 512 || 7 rounds || 2<sup>152</sup> || 2<sup>56</sup> || [http://csrc.nist.gov/groups/ST/hash/sha-3/Round2/Aug2010/documents/papers/SASAKI_ECHOanalysisFinal.pdf Sasaki,Li,Wang,Sakiyama,Ohta]
 |-
-| semi-free-start collision || compression function || 224,256 || 7 rounds (Round 1) || 2<sup>80</sup> || 2<sup>32</sup> || [http://eprint.iacr.org/2010/375.pdf Ideguchi,Tischhauser,Preneel]
+| semi-free-start collision || compression function || 224,256 || 7 rounds (Round 1/2) || 2<sup>80</sup> || 2<sup>32</sup> || [http://eprint.iacr.org/2010/375.pdf Ideguchi,Tischhauser,Preneel]
 |-
-| semi-free-start collision || compression function || 224,256 || 8 rounds (Round 1) || 2<sup>192</sup> || 2<sup>64</sup> || [http://eprint.iacr.org/2010/375.pdf Ideguchi,Tischhauser,Preneel]
+| semi-free-start collision || compression function || 224,256 || 8 rounds (Round 1/2) || 2<sup>192</sup> || 2<sup>64</sup> || [http://eprint.iacr.org/2010/375.pdf Ideguchi,Tischhauser,Preneel]
 |-
 | distinguisher || permutation || 224,256 || 7 rounds || 2<sup>19</sup> || - || [http://eprint.iacr.org/2010/375.pdf Ideguchi,Tischhauser,Preneel]
@@ Line 105: / Line 105: @@
 | distinguisher || permutation || 224,256 || 8 rounds || 2<sup>64</sup> || 2<sup>64</sup> || [http://eprint.iacr.org/2010/375.pdf Ideguchi,Tischhauser,Preneel]
 |-
-| distinguisher || compression function || 256 || 10 rounds (Round 1) || 2<sup>192</sup> || 2<sup>64</sup> || [http://eprint.iacr.org/2010/223.pdf Peyrin]
+| distinguisher || compression function || 256 || 10 rounds (Round 1/2) || 2<sup>192</sup> || 2<sup>64</sup> || [http://eprint.iacr.org/2010/223.pdf Peyrin]
 |-
-| distinguisher || compression function || 256 || 9 rounds (Round 1) || 2<sup>80</sup> || 2<sup>64</sup> || [http://eprint.iacr.org/2010/223.pdf Peyrin]
+| distinguisher || compression function || 256 || 9 rounds (Round 1/2) || 2<sup>80</sup> || 2<sup>64</sup> || [http://eprint.iacr.org/2010/223.pdf Peyrin]
 |-
-| distinguisher || compression function || 512 || 11 rounds (Round 1) || 2<sup>640</sup> || 2<sup>64</sup> || [http://eprint.iacr.org/2010/223.pdf Peyrin]
+| distinguisher || compression function || 512 || 11 rounds (Round 1/2) || 2<sup>640</sup> || 2<sup>64</sup> || [http://eprint.iacr.org/2010/223.pdf Peyrin]
 |-
-| semi-free-start collision || compression function || 256 || 7 rounds (Round 1) || 2<sup>120</sup> || 2<sup>64</sup> || [http://eprint.iacr.org/2009/531.pdf Gilbert,Peyrin]
+| semi-free-start collision || compression function || 256 || 7 rounds (Round 1/2) || 2<sup>120</sup> || 2<sup>64</sup> || [http://eprint.iacr.org/2009/531.pdf Gilbert,Peyrin]
 |-
-| distinguisher || compression function || 256 || 8 rounds (Round 1) || 2<sup>112</sup> || 2<sup>64</sup> || [http://eprint.iacr.org/2009/531.pdf Gilbert,Peyrin]
+| distinguisher || compression function || 256 || 8 rounds (Round 1/2) || 2<sup>112</sup> || 2<sup>64</sup> || [http://eprint.iacr.org/2009/531.pdf Gilbert,Peyrin]
 |-
 | distinguisher || permutation || 256 || 8 rounds || 2<sup>112</sup> || 2<sup>64</sup> || [http://eprint.iacr.org/2009/531.pdf Gilbert,Peyrin]
 |-
-| semi-free-start collision || compression function || 256 || 7 rounds (Round 1) || 2<sup>120</sup> || 2<sup>64</sup> || [http://online.tu-graz.ac.at/tug_online/voe_main2.getVollText?pDocumentNr=128007&pCurrPk=47053 Mendel,Rechberger,Schläffer,Thomsen]
+| semi-free-start collision || compression function || 256 || 7 rounds (Round 1/2) || 2<sup>120</sup> || 2<sup>64</sup> || [http://online.tu-graz.ac.at/tug_online/voe_main2.getVollText?pDocumentNr=128007&pCurrPk=47053 Mendel,Rechberger,Schläffer,Thomsen]
 |-
-| semi-free-start collision || compression function|| 384,512 || 7 rounds (Round 1) || 2<sup>152</sup> || 2<sup>64</sup> || [http://online.tu-graz.ac.at/tug_online/voe_main2.getVollText?pDocumentNr=128007&pCurrPk=47053 Mendel,Rechberger,Schläffer,Thomsen]
+| semi-free-start collision || compression function|| 384,512 || 7 rounds (Round 1/2) || 2<sup>152</sup> || 2<sup>64</sup> || [http://online.tu-graz.ac.at/tug_online/voe_main2.getVollText?pDocumentNr=128007&pCurrPk=47053 Mendel,Rechberger,Schläffer,Thomsen]
 |-
-| semi-free-start collision || compression function || 224,256 || 6 rounds (Round 1) || 2<sup>64</sup> || 2<sup>64</sup> || [http://online.tu-graz.ac.at/tug_online/voe_main2.getVollText?pDocumentNr=124407&pCurrPk=44420 Mendel,Peyrin,Rechberger,Schläffer]
+| semi-free-start collision || compression function || 224,256 || 6 rounds (Round 1/2) || 2<sup>64</sup> || 2<sup>64</sup> || [http://online.tu-graz.ac.at/tug_online/voe_main2.getVollText?pDocumentNr=124407&pCurrPk=44420 Mendel,Peyrin,Rechberger,Schläffer]
 |-
 | distinguisher || output transformation || 224,256 || 7 rounds || 2<sup>56</sup> || - || [http://online.tu-graz.ac.at/tug_online/voe_main2.getVollText?pDocumentNr=124407&pCurrPk=44420 Mendel,Peyrin,Rechberger,Schläffer]
@@ Line 127: / Line 127: @@
 | distinguisher || permutation || 224,256 || 7 rounds || 2<sup>55</sup> || - || [http://online.tu-graz.ac.at/tug_online/voe_main2.getVollText?pDocumentNr=124407&pCurrPk=44420 Mendel,Peyrin,Rechberger,Schläffer]
 |-
-| semi-free-start collision || compression function || 256 || 6 rounds (Round 1) || 2<sup>120</sup> || 2<sup>64</sup> || [http://online.tu-graz.ac.at/tug_online/voe_main2.getVollText?pDocumentNr=124409&pCurrPk=40943 Mendel,Rechberger,Schläffer,Thomsen]
+| semi-free-start collision || compression function || 256 || 6 rounds (Round 1/2) || 2<sup>120</sup> || 2<sup>64</sup> || [http://online.tu-graz.ac.at/tug_online/voe_main2.getVollText?pDocumentNr=124409&pCurrPk=40943 Mendel,Rechberger,Schläffer,Thomsen]
 |-
-| semi-free-start collision || compression function || 224,256 || 5 rounds (Round 1) || 2<sup>64</sup> || - || [http://online.tu-graz.ac.at/tug_online/voe_main2.getVollText?pDocumentNr=124409&pCurrPk=40943 Mendel,Rechberger,Schläffer,Thomsen]
+| semi-free-start collision || compression function || 224,256 || 5 rounds (Round 1/2) || 2<sup>64</sup> || - || [http://online.tu-graz.ac.at/tug_online/voe_main2.getVollText?pDocumentNr=124409&pCurrPk=40943 Mendel,Rechberger,Schläffer,Thomsen]
 |-
 | observation || hash  || all  ||  ||  ||  || [http://ehash.iaik.tugraz.at/uploads/d/d0/Grostl-comment-april28.pdf Kelsey]

@@ Line 61: / Line 61: @@
 |-
 |}
 === Building blocks ===

@@ Line 58: / Line 58: @@
 | collision || 224,256 || 3 rounds || 2<sup>64</sup> || - || [http://groestl.info/groestl-analysis.pdf Schläffer]
 |-
-| collision || 512 || 4 rounds || 2<sup>192</sup> || - || [http://groestl.info/groestl-analysis.pdf Schläffer]
+| collision || 512 || 3 rounds || 2<sup>192</sup> || - || [http://groestl.info/groestl-analysis.pdf Schläffer]
 |-
 |}
 === Building blocks ===

@@ Line 46: / Line 46: @@
 Recommended security parameter: '''10''' rounds (n=224,256); '''14''' rounds (n=384,512)
 === Hash function ===
@@ Line 139: / Line 140: @@
 |-
 |}