# Does SpongeWrap (from the Keccak team) absorb ciphertext or plaintext?

I have been reading the Cryptographic sponge functions paper, but I'm still confused.

Does Keccak in authenticated encryption mode absorb ciphertext or plaintext?

Edit: Are there any test vectors to verify implementation of Keccak authenticated encryption?

-
You absorb the plaintext, which means that the rate section of the state is equal to the ciphertext. –  figlesquidge Dec 8 '13 at 22:16
Keccak itself isn't really bothered. It just needs some input, now if that happens to be plain or ciphertext depends on the application. –  rath Dec 9 '13 at 0:21
@figlesquidge Thanks. Are there any test vectors for that? –  LightBit Dec 9 '13 at 8:29
@rath I'm asking for "standard" way. –  LightBit Dec 9 '13 at 8:32
@LightBit as far as test vectors go, you could generate them yourself using KeccakTools (github.com/gvanas/KeccakTools). Uncomment testKeccakDuplex() in the main function, rebuild, and run. You could also modify testKeccakDuplex() itself to add new test vectors. –  mattkelly Jan 23 '14 at 15:38

To implement this in terms of absorbing and squeezing, we have to use the squeezed output from the previous iteration (here called $s_r$, called $z$ in their algorithm) and xor this with the message, before absorbing in the message as part of the next call. In my mind absorbing / squeezing is a much less clear way of describing the process, but mathematically it is important since it clearly shows the object to be an instance of a Duplex Object, which is itself a series of sponges, and thus allows us to use their security proofs.