# How does the sponge construction avoid the weaknesses present in Merkle–Damgård hash function?

How are the weaknesses of the Merkle–Damgård construction (i.e. the Herding attack, multicollisions, length extension, expandable messages) avoided in the sponge construction?

• The significance of this question is that a sponge is used in SHA-3 / Keccak. May 15 '17 at 0:13
• I'm not a native English speaker, but to me, the current title seems to indicate that a sponge construction is a type of Merkle-Damgård construction. Not sure how I would rephrase it though.
– pipe
May 15 '17 at 0:25

• The permutation $F$, capacity $c$, bitrate $r$ and padding rule used in the sponge instance;
• The length of a message $m$ and its hash output $h$, but not the content of $m$. For simplicity, we'll assume the output length is $r$.
To perform a length extension, the attacker has to guess the content of the $c$ capacity bits, and test each guess against some sort of oracle that will tell them whether they hit the correct $c$-bit combination.