There seem to have been defined multiple ciphers using the Keccak sponge as building block / primitive. These seem to have escaped public attention, possibly because they have not been standardized and because current ciphers seem to cover most use cases.
I'd like to know:
Do these have any advantages over current ciphers and cipher modes such as AES-CTR, AES-GCM and Salsa20/Poly1305?
Since keccak is a relatively large permutation, implementing other symmetric schemes based on keccak besides hashing is concretely expensive. Especially given that AES has hardware acceleration on a lot of chips. However, given the versatility of the sponge duplex constructions for symmetric primitives, the Keccak Team designed a separate family of permutations called Xoodoo; that are more lightweight, but achieve a smaller security margin.
The family of cryptographic schemes based on Xoodoo is called Xoodyak. The Xoodyak constructions are finalists in the NIST Lightweight Cryptography Competition. The benefit is that since all the schemes are based on the Xoodoo permutation, a much smaller amount of code is required for a variety of symmetric primitives, which make it perfect for IOT devices.
