0
$\begingroup$

Let $\lfloor A \rfloor_B$ denote the first $B$ bits of a bitstring $A$. Let $F$ denote the underlying function of the sponge construction (for SHA-3, $F = \text{Keccak-}f[1600]$ ), assuming that bitrate is $R$, capacity is $C$ and the length of the output is $L$ (for SHA-3-512, $L = 512$ ). Note that the padded message $M$ has the following form:

$$\text{pad}(M) = B_1 \mathbin\Vert B_2 \mathbin\Vert \ldots \mathbin\Vert B_{N-1} \mathbin\Vert B_N,$$

where $B_i$ denote $R$-bit blocks.

The standard sponge construction operates as follows:

$$\begin{array}{l} {S_1} = F(B_1 \oplus_R 0^{R+C}),\\ {S_2} = F(B_2 \oplus_R S_1),\\ {S_3} = F(B_3 \oplus_R S_2),\\ \ldots,\\ {S_N} = F(B_N \oplus_R S_{N-1}),\\ \end{array}$$

where $\oplus_R$ means that $B_i$ are XORed into the first $R$ bits of the state. Then $\lfloor S_N \rfloor_L$ is the hash of $M$.

Consider the following modification of the sponge construction.

Choose any $L$-bits sequence and denote it by $V$. Then operate as follows: $$\begin{array}{l} {S_1} = F(B_1 \oplus_R 0^{R+C}),\\ {X_1} = \lfloor S_1 \rfloor_L \oplus V,\\ {S_2} = F(B_2 \oplus_R S_1),\\ {X_2} = \lfloor S_2 \rfloor_L \oplus X_1,\\ {S_3} = F(B_3 \oplus_R S_2),\\ {X_3} = \lfloor S_3 \rfloor_L \oplus X_2,\\ \ldots,\\ {S_N} = F(B_N \oplus_R S_{N-1}),\\ {X_N} = \lfloor S_N \rfloor_L \oplus X_{N-1}.\\ \end{array}$$

Then $X_N$ is the hash of $M$.

Is this modified construction cryptographically weaker than the standard sponge construction? If yes (or no), then why?

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.