security of a sponge construction

Question

I don't get why the size of C (the capacity) of a sponge construction influences the security of the sponge construction. And what is the influence of the size of R?

Answer 1

The capacity of the sponge construction refers to the section of the state that is not revealed to the adversary.

By effectively zeroing/truncating one side of the output of a permutation, it becomes difficult to apply the inverse permutation to the output and recover the original input: In order do so and end up back at the correct input, you would first need to recover the capacity bits that were not revealed. By ensuring that the capacity is large enough, it becomes computationally infeasible to guess what the capacity bits were and by extension computationally infeasible to recover the initial input to the function. This is a technique to make an invertible permutation into a one-way function.

The rate refers to the bits that are directly input/output into the permutation. A larger rate provides higher performance: Consider the extreme where the rate is only 1 bit - it would require $n$ invocations of the permutation to digest $n$ bits of data, which would be quite slow.

Conclusion

The capacity influences the security of the construction, while the rate influences the performance; Increasing one will decrease the other, as the size of the state is otherwise fixed.