The Grøstl hash family is a byte-oriented SP-network that was submitted to the NIST SHA-3 competition by a team of cryptographers from the Technical University of Denmark and TU Graz. It is a tweaked version of its predecessor called Grøstl-0, which was the original submission to the competition.

Grøstl is an iterated hash function that uses two fixed, large, different permutations constructed using the wide trail design strategy. The S-box used in Grøstl is identical to the one used in the block cipher AES, and the diffusion layers are constructed in a similar manner to those of the AES.

Grøstl is a wide-pipe construction where the size of the internal state is significantly larger than the size of the output, making all known, generic attacks on the hash function much more difficult.

Details about the specification can be found at http://www.groestl.info/.