0
$\begingroup$

Can the KangarooTwelve Keccak-p[1600,12] be used to create a CSPRNG in which there is random access to an element (or a small group of outputs) of the generated list (instead of sequential generation)?

Perhaps the k-th group of L outputs can be generated as:

  • K12(inputMessage=seed || k, customizationString="",outputByteLen=L)
Improve this question
$\endgroup$
5
  • $\begingroup$ Why use the hashing function when you can use the permutation directly? Reserve a portion of the state for the key and run a counter could just achieve what you want. $\endgroup$
    – DannyNiu
    Sep 13 at 7:49
  • $\begingroup$ If you've heard of blockciphers in counter mode, then a permutation in a counter mode should be just as familiar. $\endgroup$
    – DannyNiu
    Sep 13 at 7:50
  • $\begingroup$ @DannyNiu regarding saving a portion of the state and running a counter on the rest - is this construction secure? Will the output bits be indistinguishable from random? $\endgroup$
    – Ilan
    Sep 13 at 13:11
  • $\begingroup$ @DannyNiu regarding using block ciphers in counter mode - yes, I'm familiar with this method of PRNG. My motivation is the lower computation load of this hash function in comparison to, say AES $\endgroup$
    – Ilan
    Sep 13 at 13:15
  • $\begingroup$ Yes, it's secure. The reserved portion is called the "capacity", usually twice the length of the desired security level. To be secure, you either truncate the capacity bits after the permutation, or xor the output with the input state (the latter has some subtleties so the former is recommended). For more, see Cryptographic Sponge Functions (the link brings you to a table showing typical modes of operations of permutations). $\endgroup$
    – DannyNiu
    Sep 14 at 1:13

1 Answer 1

Reset to default
1
$\begingroup$

This answer focus on 3 things:

  1. K12 hash vs Keccak-p[1600,12].

Although K12 is a concurrent high-throughput hash function, using it for PRNG doesn't necessarily offer the best performance, since its output is serial. Keccak permutation on the other hand, can be run in some special mode of operations to provide PRNG functionality - such mode can be simpler than K12 hash, and can be more efficient if multi-threading isn't used.

I've linked to the Cryptographic Sponge Functions paper section where some modes are presented.

  1. CSPRNG vs Stream Cipher.

Note that CSPRNG isn't the same as Stream Ciphers - stream ciphers require the output be a function of the input, which means everytime same input is given (key, IV) the same output is produced. CSPRNG on the other hand, is more violent on its internal state. Every output CSPRNG produce, lead to irrecoverable loss of previous state (to prevent back-tracing cryptanalysis), and even difference in the length of requested output must lead to difference in the actual output.

Since you said you want it be capable of "random access", I assume that you intended to say stream cipher.

  1. Is it secure?

The Keccak permutation receive as much reputable analysis as Rijndael (the AES winner), so the answer is overwhelmingly yes. And given that Keccak-p[1600,12] and AES-128 (10 rounds) has similar number of rounds, and both are based on bitwise operations (binary polynomials), I'd say Keccak would have higher per-bit performance as Keccak has larger block size than AES.

There also have been lots of analysis on the sponge and duplex modes

Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.