Tagged Questions

70 views

Different padding rules for Merkle-Damgard and Keccak/sponge function

We learned that length padding was used in Merkle-Damgard where after padding with zeros another block is added that contains the initial length of the input. This is supposed to prevent same hash ...
77 views

What is the importance of the $r$ and $c$ values for the Sponge Construction?

What is the importance of the $r$ and $c$ values? Keccak[r=1600,c=0] is stated on a calculator on the Keccak website to be a checksum. But I figured if c=0, then there's only one possible output? ...
90 views

Why has the sponge construction's generic collision finding attack a complexity of O(min(2^(-n/2) , 2^(-c/2)))?

I'm trying to learn about sponge function for creating hash functions and generic attacks on it. I'm looking for the collision finding attack scenario which leads to $O(\min(2^{-n/2} , 2^{-c/2}))$ ...
In the face of non-quantum attacker, Keccak[r=1088,c=512] with 512 bits of output provides: Collision resistance up to $2^{256}$ operations Preimage resistance up to $2^{256}$ operations Second ...