It seems like the Keccak permutation is reversible, which is not making the output of SHAKE forward-secure. In the sense that if one state is leaked, everything can be recovered.

I wanted to know the reason why the permutation was not one-way. Or rather why they do not use a one-way function in place of the permutation.


Browse other questions tagged or ask your own question.