NIST defines a lot of interesting applications of sponges in FIPS 202 and NIST SP 800-185 like the XOF cSHAKE128 or the MAC scheme KMAC.

All this schemes come with a security guarantee and are explicitly based on a sponge using Keccak as its permutation.

This leads me to two questions:

  1. Do these constructions really rely on Keccak (apart from minor technical details like the padding length) or can they be adapted to different sponges without loosing security (assuming the alternative sponge function used is secure enough, of course)?
  2. Are there any papers or standards published, which propose similar constructions which are not dependent on a single sponge instance?
  • 3
    $\begingroup$ No, the constructions don't inherently depend on the permutation chosen. You could easily replace Kecccak with a reduced-round version or with eg Gimli. $\endgroup$
    – SEJPM
    Sep 7, 2017 at 9:54
  • $\begingroup$ @SEJPM Maybe also mention that Gimli cryptanalysis shows that creating a good $f$ function is not an easy thing to do… even for professionals. $\endgroup$
    – e-sushi
    Sep 7, 2017 at 12:20
  • $\begingroup$ @e-sushi I do not intend to invent my own permutation function. I just want to research, how careful I have to be in using an established sponge. $\endgroup$
    – mat
    Sep 7, 2017 at 12:25
  • 1
    $\begingroup$ Related: Can we exchange the permutation of a sponge construction? $\endgroup$
    – e-sushi
    Sep 7, 2017 at 12:25
  • $\begingroup$ @mat Always double check the work if you're able to specify an output length that is larger than the state size. $\endgroup$
    – Q-Club
    Sep 7, 2017 at 22:09


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.