# Adding parameters to sponge's capacity

Is it safe to XOR parameters like domain, length of the message or block counter into sponge's capacity or that gives attacker control over capacity?

For example NORX XORs domain into capacity.

Does this break sponge security proofs?

What about adding bit into capacity to denote that there was no padding since message was multiple of rate and therefore reducing number of permutation function executions?

PRIMATEs use padding spilling which is similar to no-padding bit. Their paper says:

Note that the spilling of the padding in case |M[w]| = r causes security to degrade by half a bit: intuitively, APE is left with a capacity of c' = c - 1.

However, it looks like this doesn't apply to HANUMAN and GIBBON which also use the same padding spilling.

• Comments are not for extended discussion; this conversation has been moved to chat. – e-sushi Jan 27 '18 at 9:40

As a pathological example of how this could go wrong, imagine a protocol where one part uses $$\operatorname{SHA-256}(x)$$ as a public identifier for something, and another part uses $$\operatorname{SHA-256}(\operatorname{SHA-256}(x))$$ as a secret, each of which use is independently essentially fine (except for potential generic issues with $$H^2$$). Obviously this combination of uses could be exploited to learn the secret. Were the number of iterations of SHA-256 hashed into the message, as in $$\operatorname{SHA-256}(1 \mathbin\| x)$$ and $$\operatorname{SHA-256}(2 \mathbin\| \operatorname{SHA-256}(2 \mathbin\| x))$$ instead, there would be no such danger.