Wikipedia has this diagram of a sponge construction.
Sponge construction

Why is this better than just cycling the output to the input? Like this, assuming $p$ is a list of blocks that are equal to the size of $f()$, and $z$ is the corresponding output.

$$c_{-1} = 0\\ c_{n} = f(c_{n-1} \oplus p_{n})\\ z_{n} = f(z_{n-1})$$

Or in other words, why not have $r$ be the whole block?


why not have $r$ be the whole block?

Because you'd essentially have no security.

  • In the absorbing phase, the attacker could set the intermediate state to whatever he wants. For example, if the current state is $c_{n-1}$ and the attacker wants the next state to be $t$, he computes $p_n = c_{n-1} \oplus f^{-1}(t)$; this allows a trivial preimage attack. And, even if $f$ wasn't invertible, this would still allow a trivial second preimage attack.

  • In the squeezing phase, if the attacker knows the value $z_0$, he could trivially compute the rest of the hash $z_1, z_2, ...$


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.