There seem to have been defined multiple ciphers using the Keccak sponge as building block / primitive. These seem to have escaped public attention, possibly because they have not been standardized and because current ciphers seem to cover most use cases.

I'd like to know:

  • Which ones have been defined?
  • What are the differences between them?
  • And which purpose do they serve?

Do these have any advantages over current ciphers and cipher modes such as AES-CTR, AES-GCM and Salsa20/Poly1305?

  • $\begingroup$ I know at least about Ketje and Keyak. Apparently Xoodoo and related algorithms are not directly based on Keccak. $\endgroup$
    – Maarten Bodewes
    Commented Jan 26, 2023 at 18:35

1 Answer 1


Since keccak is a relatively large permutation, implementing other symmetric schemes based on keccak besides hashing is concretely expensive. Especially given that AES has hardware acceleration on a lot of chips. However, given the versatility of the sponge duplex constructions for symmetric primitives, the Keccak Team designed a separate family of permutations called Xoodoo; that are more lightweight, but achieve a smaller security margin.

The family of cryptographic schemes based on Xoodoo is called Xoodyak. The Xoodyak constructions are finalists in the NIST Lightweight Cryptography Competition. The benefit is that since all the schemes are based on the Xoodoo permutation, a much smaller amount of code is required for a variety of symmetric primitives, which make it perfect for IOT devices.

  • $\begingroup$ That's interesting for sure but a it doesn't seem to use Keccak I'm not sure it answers the question directly. I know of at least twi ciphered that do use Keccak. $\endgroup$
    – Maarten Bodewes
    Commented Jan 26, 2023 at 20:00
  • $\begingroup$ Yes, I agree this doesn't directly answer the question. The reason why I mention Xoodyak is because it's a NIST finalist, which is in itself a standardization process. $\endgroup$
    – Wilson
    Commented Jan 26, 2023 at 22:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.