Questions tagged [sponge]

The cryptographic sponge is a construction scheme for hash functions (and other symmetric primitives) based on an unkeyed permutation. The most famous example is Keccak, which won the SHA-3 competition.

Filter by
Sorted by
Tagged with
0 votes
1 answer
44 views

Can f(S) also be replaced by PRP(S) in a Sponge consruction?

I have difficulties understanding the PRP in the absorb phase of a sponge construction: a block is XORed to the r part of the state memory,and then the entire state sent through a blockcipher-like ...
Even darker than dark's user avatar
0 votes
1 answer
63 views

Is this an example of a sponge construction?

I am having difficulties understanding a sponge construction, as I don't really understand whether the long internal state of a sponge construction is compressed in the squeeze phase, or whether bits ...
RA35's user avatar
  • 13
3 votes
0 answers
81 views

Preimage resistance of sponge-based hashes and XOFs

In the sponge construction for hash functions, including SHA3 and SHAKE, its used a permutation $$f:\{0,1\}^r\times\{0,1\}^c\to\{0,1\}^r\times\{0,1\}^c\\ \;\quad(R,C)\quad\quad\mapsto\quad\;(R',C')$$ ...
fgrieu - mod election time's user avatar
2 votes
1 answer
76 views

Oribatida masking question

Why Oribatida uses previous capacity $V_{a+m-1}$ instead of current capacity $V_{a+m}$ for rate masking?
LightBit's user avatar
  • 1,649
3 votes
0 answers
113 views

Sponge capacity feed-forward

Consider Sponge construction where capacity part of state is feed-forward and xor-ed into next state. ${state}_{i+1} = F({{state}_i}^{rate} || {{state}_i}^{capacity}) \oplus (0^{rate} || {{state}_i}^{...
LightBit's user avatar
  • 1,649
0 votes
0 answers
79 views

Full-Block Cipher Feedback Mode as a complete AEAD with a free MAC?

Full-State Keyed Sponge (aka Donkey Sponge) appears to cross over into block cipher mode territory such as Full Block Cipher Feedback Mode: Full State Keyed Sponge (FKS) construction: FKS has been ...
LightTunnelEnd's user avatar
1 vote
0 answers
136 views

Can a Full-State Keyed Sponge be used as AEAD by using XEX?

Full-State Keyed Sponge (aka Donkey Sponge) is when a message is absorbed into the full state of the sponge. Such an approach to MAC construction is considered secure. 1 However for an AEAD or a ...
LightTunnelEnd's user avatar
3 votes
2 answers
320 views

Are sponges inherently inefficient when compared to other constructions?

A sponge has by definition 'wasted' operations (the part of the state which always remains private but goes through all the ops of the permutation). In return for that waste you get a MAC at the end - ...
LightTunnelEnd's user avatar
4 votes
1 answer
134 views

How is the Full-State Keyed duplex useful?

In the Full-State Keyed duplex (sponge construction AEAD), plaintext is absorbed into the entire state of the sponge permutation but only a portion of the output can be used else the scheme breaks (...
LightTunnelEnd's user avatar
3 votes
1 answer
122 views

Key blinding security in Ascon

This article explains the role of key blinding in Ascon. Key blinding in Ascon involves XORing the key with the capacity part after the permutation in both the initialization and finalization stages. ...
hardyrama's user avatar
  • 2,124
3 votes
1 answer
80 views

Security level of sponge construction based on output and capacity

I was looking at the security level of instances of sponge construction on Wikipedia depicted in the following image. It seems to me that the security level for collision resistance follows the ...
A.Solei's user avatar
  • 405
1 vote
2 answers
179 views

Sponge construction versus Merkle-Damgard For Hashing based on the very same primitive

I am a bit confused about Sponge construction and Merkle-Damgard-style ones for hashing. The only advantage I see for sponge construction is that they are secure against length extension attacks. So ...
A.Solei's user avatar
  • 405
2 votes
4 answers
195 views

How is the $\chi$ step of the Keccak permutation invertible?

I would like to understand how Keccak's permutation function is reversible. The difficulty I have is with the $\chi$ step that uses the and operator which is not revertible. All the other ...
glurks's user avatar
  • 23
2 votes
1 answer
42 views

How is the message considered in the STROBE-based Schnorr signature example?

I've been studying the Schnorr signature scheme and recently came across an example that uses the STROBE protocol. In the classic version of Schnorr signatures, the challenge e is calculated as e = H(...
Paul Yu's user avatar
  • 156
4 votes
1 answer
107 views

Which ciphers have been defined that use the Keccak sponge?

There seem to have been defined multiple ciphers using the Keccak sponge as building block / primitive. These seem to have escaped public attention, possibly because they have not been standardized ...
Maarten Bodewes - mod election's user avatar
2 votes
1 answer
116 views

How do the c-bits (capacity bits) make the sponge construction better?

I know that the message never directly changes those last c bits of the internal state (as seen in the image). And I also know that the capacity bits make the sponge construction resistant against ...
questions change the world's user avatar
4 votes
1 answer
110 views

256-bit security with Sponges

Cryptographic sponge functions are a hot topic right now with LWC and all. They solve the symmetric crypto problem with simplicity and efficiency. However, none of them seem to achieve 256-bit ...
luiz's user avatar
  • 41
3 votes
0 answers
138 views

ChaCha-based Sponge PRNG fails PractRand suite

TL;DR: My simple ChaCha-based sponge PRNG is getting "unusual" evaluation from PractRand test battery pretty reliably, sometimes even within the first GB; I'm trying understand why. I was in ...
Marandil's user avatar
  • 139
2 votes
1 answer
139 views

Sponge Duplex authenticated encryption with nonce reuse or no nonce

With a Sponge permutation in a Duplex construction for authenticated encryption. illustration example: ascon; actual interest if relevant: keccak Suppose there is no associated data and there is no ...
Lauren Fen.'s user avatar
3 votes
1 answer
167 views

Indifferentiability of Sponge Construction

In the case of sponge construction, it is shown to be differentiable from a RO. In the paper by Bertoni et al., what is meant by the node being saturated. How does it become saturated and the ...
Novice_researcher's user avatar
1 vote
0 answers
585 views

How to implement a basic "sponge function"?

In Chapter 6 of Serious Cryptography, they write about the sponge function: It XORs the first message block, M1, to H0, a predefined initial value of the internal state (for example, the all-zero ...
Lance's user avatar
  • 171
0 votes
0 answers
51 views

Synchronous Sponges

The paper The sponge construction as a source of secure cryptographic primitives (see Figure 6) mentions a synchronous sponge mode (working like CTR or OFB modes). So, this type of sponge is a non-...
user's user avatar
  • 173
4 votes
2 answers
193 views

Why does TinyJAMBU-128 claim only 112-bit security?

I am trying to understand the security level of TinyJAMBU-128. As shown in Table 4.1 page 12 of this document, TinyJAMBU-128 claims 112-bit security. However, it has a 128-bit key. How have we lost 16 ...
user's user avatar
  • 173
3 votes
2 answers
748 views

Is it possible to create a ciphersuite for TLS 1.3 using only the Keccak-sponge/duplex?

Now that Keccak has been chosen as SHA-3 we see that there have been defined quite a few related modes, including authenticated cipher modes, the KMAC message authentication mode, XOF's and whatnot. ...
Maarten Bodewes - mod election's user avatar
4 votes
2 answers
359 views

How does KECCAK operate on a state array filled with zeros?

Im trying to implement a sponge in Java. The state starts out as an empty 200 byte array of all zeros. In the KMAC samples document from NIST, the following happens: (black line is a pdf page break) ...
Dustinvonsandwich's user avatar
3 votes
1 answer
396 views

Why HAIFA and sponge constructions are not prone to length extension attacks?

I was writing in a document about the flaws of the MD construction which pushed cryptographers to create different and more robust constructions. However, I don't know why HAIFA and Sponge ...
Hinton Zsh's user avatar
10 votes
2 answers
5k views

What is the sponge construction in simple terms?

I suggested to my client to use SHA3 instead of SHA2. I know that SHA3 is based on Keccak algorithm which won the NIST's competition. I want to explain the structure of sponge functions in very simple ...
Sam Claro's user avatar
  • 101
2 votes
2 answers
267 views

Absorbing r + c bits in first round of a sponge function

In the standard sponge construction, r bits are consumed in each absorption step, and they get concatenated with c capacity bits....
Daniel Lubarov's user avatar
1 vote
1 answer
199 views

What is the rationale design of TinyJambu-LWC?

My understanding of duplex construction is usually initialized with the key at the beginning of the mode, but I have noticed that TinyJambu (in addition to key intilization) is using key in each ...
hardyrama's user avatar
  • 2,124
4 votes
1 answer
372 views

Why is the internal chacha20 permutation vulnerable to attacks if used in a sponge construction?

The user Forest in here claims that the internal chacha20 permutation is "vulnerable to attacks if it were used in a sponge construction". My question is as follows: What are these attacks? Would ...
8321992485's user avatar
9 votes
1 answer
374 views

Sponge with PRF instead of PRP

In most uses of Sponge mode of operations such as SHA3 and many of the round-2 candidates in the NIST lightweight cryptography project, the underlaying primitive is a cryptographic permutation - that ...
DannyNiu's user avatar
  • 9,168
0 votes
2 answers
273 views

what are the benefits/limits of constructing AEAD using Duplex mode with ARX primitive (chacha20 for example)?

I understand that WAGE cipher uses duplex/sponge mode with stream based cipher for Authenticated encryption with associated data (AEAD) and NORX uses duplex/sponge mode with LRX structure , so , Is ...
hardyrama's user avatar
  • 2,124
6 votes
1 answer
483 views

Rationale for NORX/Ketje/Keyak not being chosen for the CAESAR final portfolio

Was any specific rationale given on why none of the sponge-based AEAD algorithms (specifically NORX, Keyak, and Ketje) of the 3rd round candidates of the CAESAR competition made it to the final ...
Astolfo's user avatar
  • 149
0 votes
1 answer
2k views

SHA-3 Step by step?

Can somebody explain me or give me a link of a step by step SHA-3 explanation it has been really hard for me to undesrtand it. I would love to see an explanation since it's input untill the digest is ...
Luis Fernando Badel Méndez's user avatar
2 votes
1 answer
351 views

Can any hash function based on the sponge construction work as extendable output function?

Keccak provides a sort of very useful XOFs. Can other sponge construction hash function like Spongent work as XOF? Is there any lightweight XOF for hardware or software implementation?
Zachary's user avatar
  • 177
2 votes
1 answer
353 views

Random permutation of bit strings of length $n$, where $n$ can be any positive integer?

I need an efficient, invertible random permutation of $n$-bit strings, defined by a $128$-bit key. $n$ can be any positive integer from $6$ to $128$. I have no requirements on the security of the ...
user664303's user avatar
2 votes
1 answer
382 views

Capacity bits in SHA-3

I am trying to understand the sponge construction, and in the official web site I found this sentence: The last c bits of the state are never directly affected by the input blocks and are never ...
Hoper's user avatar
  • 123
3 votes
1 answer
366 views

Is it possible to apply a pseudo-random permutation (a keyed permutation) to construct a sponge function?

The description of the sponge function on Crypto.Stackexchange contains the following text The cryptographic sponge is a construction scheme for hash functions (and other symmetric primitives) based ...
lyrically wicked's user avatar
4 votes
2 answers
690 views

Intuition for SHA3 sponge construction

I would like to get some intuition on the security of the sponge construction. I'm referring to this diagram and notation. Let's consider the case where we have don't apply $f$ in the squeezing ...
user1936752's user avatar
4 votes
2 answers
533 views

Usage and limitations of sponge functions for PRNG

This HRNG uses SHA3 as a sponge function (in its device driver) to inflate ots raw source output to many MByte/s. They compare this output rate to the output of other HRNG which don't use a sponge ...
jans's user avatar
  • 287
2 votes
0 answers
54 views

Adding the key in the first state of keyed sponge-based hash function [closed]

What are the advantages to add the key in the inner or outer part of first state in keyed sponge hash functions?
Nabil's user avatar
  • 21
3 votes
1 answer
403 views

How can one build $2^{c/2}$ attack on sponge hash?

Let $H$ be a sponge hash with rate $r$ and capacity $c$, built from a permutation $\pi: \{0, 1\}^n \rightarrow \{0, 1\}^n$, where $n = r + c$. Assuming $r \ge 2c$, how can I find a collision with ...
Daniel's user avatar
  • 457
3 votes
2 answers
184 views

What are the consequences if someone finds the accessible 1600-bit block $X$ and $R$-bit block $V$ such that $\text{Keccak-}f[1600](X \oplus V) = X$?

Let $H$ denote any hash function based on the sponge construction. Let $F$ denote its underlying function that transforms the $L$-bit state (for SHA-3, $F = \text{Keccak-}f[1600]$ ). Let $R$ denote ...
lyrically wicked's user avatar
12 votes
2 answers
4k views

Why is SHA-3 a Sponge function?

A sponge function is supposed to be able to generate an arbitrary length of output. Yet, SHA3 (Bouncycastle) constrains me to choose an output length between 224, 256, 384, and 512. Evidently, these ...
user56848's user avatar
  • 121
4 votes
1 answer
589 views

security of a sponge construction

I don't get why the size of C (the capacity) of a sponge construction influences the security of the sponge construction. And what is the influence of the size of R?
tomak's user avatar
  • 215
2 votes
1 answer
211 views

Is the Keccak family of sponge constructions the same as SHA-3?

I can't seem to come across a clear and to the point answer. Is SHA-3 in the same situation as ElGamal and DSA, where it is modified slightly, or is the original Keccak submission the exact same as ...
Expectator's user avatar
4 votes
1 answer
190 views

Is it theoretically possible for the output of SHAKE to be an infinite concatenation of the same 512-bit block?

Let $X$ denote a particular 512-bit sequence. Let $A,B,C$ denote sequences of bits such that: $$len(X || A) = len(X || B) = len(X || C) = 1600$$ $$\operatorname{Keccak-}f(X||A) = X||B$$ $$\...
lyrically wicked's user avatar
2 votes
0 answers
190 views

Using NIST constructions based on Keccak like cSHAKE128 for other sponges

NIST defines a lot of interesting applications of sponges in FIPS 202 and NIST SP 800-185 like the XOF cSHAKE128 or the MAC scheme KMAC. All this schemes come with a security guarantee and are ...
mat's user avatar
  • 2,508
6 votes
1 answer
1k views

Merkle trees instead of the Sponge or the Merkle-Damgård constructions for the design of cryptorgraphic hash functions

Most modern cryptographic hash functions use some form of compression function combined with a construction such as the Merkle-Damgård (MD5, SHA1, SHA2, etc), the Sponge construction (with Keccak as a ...
Rukako's user avatar
  • 135
6 votes
1 answer
395 views

Simple compression functions an sponge functions for educational purposes

For block ciphers, there are the very well designed schemes of Simple-DES and Simple-AES, which have been created not for security but for teaching the design principles of the real algorithms while ...
mat's user avatar
  • 2,508