I don't get why the size of C (the capacity) of a sponge construction influences the security of the sponge construction. And what is the influence of the size of R?


1 Answer 1


The capacity of the sponge construction refers to the section of the state that is not revealed to the adversary.

By effectively zeroing/truncating one side of the output of a permutation, it becomes difficult to apply the inverse permutation to the output and recover the original input: In order do so and end up back at the correct input, you would first need to recover the capacity bits that were not revealed. By ensuring that the capacity is large enough, it becomes computationally infeasible to guess what the capacity bits were and by extension computationally infeasible to recover the initial input to the function. This is a technique to make an invertible permutation into a one-way function.

The rate refers to the bits that are directly input/output into the permutation. A larger rate provides higher performance: Consider the extreme where the rate is only 1 bit - it would require $n$ invocations of the permutation to digest $n$ bits of data, which would be quite slow.


The capacity influences the security of the construction, while the rate influences the performance; Increasing one will decrease the other, as the size of the state is otherwise fixed.

  • $\begingroup$ How is the output length decided and how does the output size affect the security? can we say the security level is min{c/2,l/2} l for the output size? $\endgroup$
    – A.Solei
    Aug 7, 2023 at 8:04
  • $\begingroup$ for SHA-256 why do we have a capacity of 512, why not 256? like this with the same security level we have faster hashing! $\endgroup$
    – A.Solei
    Aug 7, 2023 at 8:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.