With padding removed and all messages multiple of the rate, Keccak (or a generic sponge-constructed hash) is collision-resistant under appropriate hypothesis on the sponge function and parameters. However it has one undesirable property: the empty message hashes to all-zero.

Padding of sponge functions is constructed on top of that, so that

• All padded messages are a multiple of the rate.
• Two distinct messages yield different padded messages,for collision resistance.
• No padded messages is empty, so that it's hard to find a preimage of all-zero.

Further, the padding of the SHA-3 functions is such that two distinct (message, function) pairs yield different padded messages. That makes it hard to find $M$, $M'$ with $\operatorname{SHA3-256}(M)=\operatorname{SHAKE256}(M',256)$. or such that $\operatorname{SHA3-224}(M)$ is the first 28 bytes of $\operatorname{SHA3-256}(M')$.

With padding removed and all messages multiple of the rate, Keccak (or a generic sponge-constructed hash) is collision-resistant under appropriate hypothesis on the sponge function and parameters. However it has one somewhat undesirable property: the empty message leaves the sponge in the initial state, that is all-zero, after absorption.

Padding of sponge functions is constructed on top of that, so that

• All padded messages are a multiple of the rate.
• Two distinct messages yield different padded messages,for collision resistance.
• No padded messages is empty, so that there's at least one sponge absorption cycle.

Further, the padding of the SHA-3 functions is such that two distinct (message, function) pairs yield different padded messages. That makes it hard to find $M$, $M'$ with $\operatorname{SHA3-256}(M)=\operatorname{SHAKE256}(M',256)$. or such that $\operatorname{SHA3-224}(M)$ is the first 28 bytes of $\operatorname{SHA3-256}(M')$.

With padding removed and all messages multiple of the rate, Keccak (or a generic sponge-constructed hash) is believed collision-resistant. However it has one undesirable property: the empty message hashes to all-zero.

Padding of sponge functions is constructed on top of that, so that

• All padded messages are a multiple of the rate.
• Two distinct messages yield different padded messages,for collision resistance.
• No padded messages is empty, so that it's hard to find a preimage of all-zero.

Further, the padding of the SHA-3 functions is such that two distinct (message, function) pairs yield different padded messages. That makes it hard to find $M$, $M'$ with $\operatorname{SHA3-256}(M)=\operatorname{SHAKE256}(M',256)$. or such that $\operatorname{SHA3-224}(M)$ is the first 28 bytes of $\operatorname{SHA3-256}(M')$.

With padding removed and all messages multiple of the rate, Keccak (or a generic sponge-constructed hash) is collision-resistant under appropriate hypothesis on the sponge function and parameters. However it has one undesirable property: the empty message hashes to all-zero.

Padding of sponge functions is constructed on top of that, so that

• All padded messages are a multiple of the rate.
• Two distinct messages yield different padded messages,for collision resistance.
• No padded messages is empty, so that it's hard to find a preimage of all-zero.

Further, the padding of the SHA-3 functions is such that two distinct (message, function) pairs yield different padded messages. That makes it hard to find $M$, $M'$ with $\operatorname{SHA3-256}(M)=\operatorname{SHAKE256}(M',256)$. or such that $\operatorname{SHA3-224}(M)$ is the first 28 bytes of $\operatorname{SHA3-256}(M')$.