# Does SpongeWrap (from the Keccak team) absorb ciphertext or plaintext?

I have been reading the Cryptographic sponge functions paper, but I'm still confused.

Does Keccak in authenticated encryption mode absorb ciphertext or plaintext?

Edit: Are there any test vectors to verify implementation of Keccak authenticated encryption?

-
You absorb the plaintext, which means that the rate section of the state is equal to the ciphertext. – figlesquidge Dec 8 '13 at 22:16
Keccak itself isn't really bothered. It just needs some input, now if that happens to be plain or ciphertext depends on the application. – rath Dec 9 '13 at 0:21
@figlesquidge Thanks. Are there any test vectors for that? – LightBit Dec 9 '13 at 8:29
@rath I'm asking for "standard" way. – LightBit Dec 9 '13 at 8:32
@LightBit as far as test vectors go, you could generate them yourself using KeccakTools (github.com/gvanas/KeccakTools). Uncomment testKeccakDuplex() in the main function, rebuild, and run. You could also modify testKeccakDuplex() itself to add new test vectors. – mattkelly Jan 23 '14 at 15:38

The authenticated encryption mode devised by the Keccak team is the SpongeWrap method, and is first described in this paper — the paper you cite is an amalgamation of all their major sponge papers. The encryption method wrap is described in Algorithm 3, on page 10. In particular, lines 14–18 absorb-squeeze with respect to the ciphertext.

In practice it is probably simpler to think of it in the following way:

To implement this in terms of absorbing and squeezing, we have to use the squeezed output from the previous iteration (here called $s_r$, called $z$ in their algorithm) and xor this with the message, before absorbing in the message as part of the next call. In my mind absorbing / squeezing is a much less clear way of describing the process, but mathematically it is important since it clearly shows the object to be an instance of a Duplex Object, which is itself a series of sponges, and thus allows us to use their security proofs.

I do not know of any test vectors for SpongeWrap.

-
@Ilmari: Thanks very much for the image! Unfortunately perp doesn't seem to be a constant-width character, rather breaking my ascii art :( – figlesquidge Dec 9 '13 at 18:19