I have been reading the Cryptographic sponge functions paper, but I'm still confused.

Does Keccak in authenticated encryption mode absorb ciphertext or plaintext?

Edit: Are there any test vectors to verify implementation of Keccak authenticated encryption?

  • 1
    $\begingroup$ You absorb the plaintext, which means that the rate section of the state is equal to the ciphertext. $\endgroup$ Commented Dec 8, 2013 at 22:16
  • 4
    $\begingroup$ Keccak itself isn't really bothered. It just needs some input, now if that happens to be plain or ciphertext depends on the application. $\endgroup$
    – rath
    Commented Dec 9, 2013 at 0:21
  • $\begingroup$ @figlesquidge Thanks. Are there any test vectors for that? $\endgroup$
    – LightBit
    Commented Dec 9, 2013 at 8:29
  • $\begingroup$ @rath I'm asking for "standard" way. $\endgroup$
    – LightBit
    Commented Dec 9, 2013 at 8:32
  • 2
    $\begingroup$ @LightBit as far as test vectors go, you could generate them yourself using KeccakTools (github.com/gvanas/KeccakTools). Uncomment testKeccakDuplex() in the main function, rebuild, and run. You could also modify testKeccakDuplex() itself to add new test vectors. $\endgroup$
    – mattkelly
    Commented Jan 23, 2014 at 15:38

1 Answer 1


The authenticated encryption mode devised by the Keccak team is the SpongeWrap method, and is first described in this paper — the paper you cite is an amalgamation of all their major sponge papers. The encryption method wrap is described in Algorithm 3, on page 10. In particular, lines 14–18 absorb-squeeze with respect to the ciphertext.

In practice it is probably simpler to think of it in the following way:

SpongeWrap diagram

To implement this in terms of absorbing and squeezing, we have to use the squeezed output from the previous iteration (here called $s_r$, called $z$ in their algorithm) and xor this with the message, before absorbing in the message as part of the next call. In my mind absorbing / squeezing is a much less clear way of describing the process, but mathematically it is important since it clearly shows the object to be an instance of a Duplex Object, which is itself a series of sponges, and thus allows us to use their security proofs.

I do not know of any test vectors for SpongeWrap.

  • $\begingroup$ @Ilmari: Thanks very much for the image! Unfortunately perp doesn't seem to be a constant-width character, rather breaking my ascii art :( $\endgroup$ Commented Dec 9, 2013 at 18:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.