0
$\begingroup$

I have difficulties understanding the PRP in the absorb phase of a sponge construction: a block is XORed to the r part of the state memory,and then the entire state sent through a blockcipher-like pseudorrandom permutation in CBC-Mode or is it simply seen as an output of a pseudorrandom function f or can you do both? If you can use both options,which of these options is more commonly taken? I would really thank everyone to come across and answer this,as I am really not sure as to how I can understand the role of the PRF/PRP in the absorb phase of the sponge construction.

$\endgroup$

1 Answer 1

0
$\begingroup$

I have difficulties understanding the PRP in the absorb phase of a sponge construction

This is a good question. The key is that sponge constructions do not use a PRP. The (usual) sponge construction uses a public random permutation instead. The difference is that the adversary can evaluate a public permutation directly while evaluating a PRP requires some "oracle".

So, graphically and functionally speaking, the CBC mode has similarities, but these aren't directly related, at least if we are talking about unkeyed sponge constructions.

is it simply seen as an output of a pseudorrandom function f or can you do both?

Just like the CBC mode creates a PRF from a PRP or a random function as a building block, the sponge construction can also be instantiated with either a permutation or a random function (or transformation). However, note that the permutation or the random function is publicly available in the latter case. Both options are good. In both cases, one can show that the sponge construction "behaves" like a random oracle via an indifferentiability analysis. Roughly, that notion generalizes indistinguishability and guarantees that a sponge is as good as a random oracle, assuming the permutation or function was randomly chosen. However, using permutations seems to give better security bounds.

If you can use both options,which of these options is more commonly taken?

Current deployments of sponge constructions like SHA3 or ascon use permutations. I am not aware of any construction that relies on a random function. As far as I understand, permutations seem to be easier to build. However, I am not an expert in designing symmetric primitives.

Updates

A comment below mentions a transformation-based sponge named gluon that didn't see as much success as other constructions. See this answer for further discussion on the preference for permutations rather than transformation.

$\endgroup$
1
  • 1
    $\begingroup$ Gluon uses random function. I once asked the Keccak team and got a reply from Joan Daemen. In his opinion, Gluon isn't much of a success compared to other schemes based on permutations. $\endgroup$
    – DannyNiu
    Mar 13 at 0:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.