# Can we use the sponge construct to efficiently authenticate any cipher?

The sponge construct facilitates authenticated encryption independently of the function used to mix its state. Could we use any strong cipher (i.e. AES-256) as the mixing function in a sponge to produce a fast authenticated encryption primitive? This question indicates that using a block cipher in the context of a mixing function for a sponge should be secure

Assume the interface of the sponge construct in question accepts a key and iv to provide to the underlying block cipher, so that the cipher can be used as otherwise intended.

The main consideration I see is that of the size of the capacity + rate compared to that of the cipher. Supposing the size of the rate and capacity were equal to the blocksize of the cipher, well, it seems like that would simply be too small? The security of a sponge appears to be related to it's capacity, so using a 64 or 128 bit capacity makes me second guess the idea, and even that would only leave 192 or 128 bits left for actual enciphering of data.

I imagine a workaround as being enciphering the entire state as a message under a standard mode of operation such as cbc, but I am unsure as to whether or not there are problems with the idea. This question seems to more or less address this, but will take me some time to totally understand due to the depth.

• for a good sponge, you need at least a permutation that operates on 256 bits (or more preferably for a decent rate). You won't get this with the standard modes. You can however use something like EME (which would give you at most a 16kbit permutation) for this. The question then becomes: Is this faster than using a dedicated, unkeyed permutation? Mar 4, 2016 at 20:52
• you can build a permutation from an unkeyed AES round function very easily. arrange state in cube, 2x2x2, perform 2 AES rounds across each pair of vectors, and you have a 1024-bit nonlinear permutation Mar 4, 2016 at 21:51