There seem to have been defined multiple ciphers using the Keccak sponge as building block / primitive. These seem to have escaped public attention, possibly because they have not been standardized and because current ciphers seem to cover most use cases.
I'd like to know:
- Which ones have been defined?
- What are the differences between them?
- And which purpose do they serve?
Do these have any advantages over current ciphers and cipher modes such as AES-CTR, AES-GCM and Salsa20/Poly1305?