# Is a strong block cipher usable as a strong sponge function?

From the literature, it looks like the security proofs of sponge functions depend on how well they approximate a random permutation, Since a block cipher also ideally behaves like a random permutation does that mean strong block ciphers make for strong sponge functions?

As in, can I expect:

extern char *input,*output;
extern int input_length,output_length;

char block[16] = {0};
char key[16] = {0};
for(i = 0; i < input_length; i++) {
AES128_ecrypt(key,block,block);
block[0] ^= input[i]
}
for (i = 0; i < output_length; i++) {
AES128_encrypt(key,block,block);
output[i] = block[0];
}


to be a cryptographically strong sponge hash of rate 8 bits and capacity 120 bits and hence be strong against $2^{60}$ attacks?

• What's a bit annoying here is that you need to make relatively strong assumptions about the block cipher, not just that it's a PRP. – CodesInChaos Dec 9 '14 at 12:29

I believe that, in this specific case, you are correct; it would appear to take $2^{60}$ effort to find a collision in the above function.