On the Indifferentiability of the Grøstl Hash Function

The notion of indifferentiability, introduced by Maurer et al., is an important criterion for the security of hash functions. Concretely, it ensures that a hash function has no structural design flaws and thus guarantees security against generic attacks up to the proven bounds. In this work we prove the indifferentiability of Grostl, a second round SHA-3 hash function candidate. Grostl combines characteristics of the wide-pipe and chop-Merkle-Damgard iterations and uses two distinct permutations P and Q internally. Under the assumption that P and Q are random l-bit permutations, where l is the iterated state size of Grostl, we prove that the advantage of a distinguisher to differentiate Grostl from a random oracle is upper bounded by O((Kq)4/2l), where the distinguisher makes at most q queries of length at most K blocks. This result implies that Grostl behaves like a random oracle up to q = O(2n/2) queries, where n is the output size. Furthermore, we show that the output transformation of Grostl, as well as 'Grostail' (the composition of the final compression function and the output transformation), are clearly differentiable from a random oracle. This rules out indifferentiability proofs which rely on the idealness of the final state transformation.