Does information about known input&output for SHA3-256 help to find KECCAK-256 input for the same output?

Question

I received two distinct outcomes from a single input using SHA3-256 and KECCAK-256:

input -->   sha3-256 --> output1

input --> keccak-256 --> output2

I want to find input2, which will give me output1 after Keccak-256 hash :

input2 --> keccak-256 -> output1

Is it somewhat possible? I read somewhere that SHA3-256 and keccak-256 have only difference in padding rule. Is it possible that known input and output information for a similar algorithm (SHA3-256) can somehow help to find correct input2 data?

Answer 1

Based on this source, KECCAK-256 (which I assume is the question's keccak-256) is a hash used by Ethereum, such that KECCAK-256(M) is Kᴇᴄᴄᴀᴋ[512](M, 256) per the terminology in FIPS 202.

SHA3-256(M) = Kᴇᴄᴄᴀᴋ[512](M ∥ 01, 256). It follows SHA3-256(M) = KECCAK-256(M ∥ 01). That matches the question's "SHA3-256 and keccak-256 have only difference in padding rule".

Thus what the question asks is possible if we manage to make a correct guess of input, which we can verify by checking SHA3-256(input) = output1; and we are free to set input2 to be input ∥ 01, where 01 is a two-bit bitstring. It follows that KECCAK-256(input2) = output1 as desired.

The only alternate possibilities to find an input2 involve a preimage attack of KECCAK-256, which is believed practically impossible.

If we want to verify KECCAK-256(input) = output2 and KECCAK-256(input2) = output1, we need that the implementation of KECCAK-256 accepts both input and input ∥ 01. That requires handling of messages of length not a multiple of 8 bits, which is not supported by all implementations.