This question already has an answer here:

It seems like the Keccak permutation is reversible, which is not making the output of SHAKE forward-secure. In the sense that if one state is leaked, everything can be recovered.

I wanted to know the reason why the permutation was not one-way. Or rather why they do not use a one-way function in place of the permutation.


marked as duplicate by Luis Casillas, otus, e-sushi Jun 2 '17 at 9:11

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

Browse other questions tagged or ask your own question.