Let $\lfloor A \rfloor_B$ denote the first $B$ bits of a bitstring $A$. Let $F$ denote the underlying function of the sponge construction (for SHA-3, $F = \text{Keccak-}f[1600]$ ), assuming that bitrate is $R$, capacity is $C$ and the length of the output is $L$ (for SHA-3-512, $L = 512$ ). Note that the padded message $M$ has the following form:

$$\text{pad}(M) = B_1 \mathbin\Vert B_2 \mathbin\Vert \ldots \mathbin\Vert B_{N-1} \mathbin\Vert B_N,$$

where $B_i$ denote $R$-bit blocks.

The standard sponge construction operates as follows:

$$\begin{array}{l} {S_1} = F(B_1 \oplus_R 0^{R+C}),\\ {S_2} = F(B_2 \oplus_R S_1),\\ {S_3} = F(B_3 \oplus_R S_2),\\ \ldots,\\ {S_N} = F(B_N \oplus_R S_{N-1}),\\ \end{array}$$

where $\oplus_R$ means that $B_i$ are XORed into the first $R$ bits of the state. Then $\lfloor S_N \rfloor_L$ is the hash of $M$.

Consider the following modification of the sponge construction.

Choose any $L$-bits sequence and denote it by $V$. Then operate as follows: $$\begin{array}{l} {S_1} = F(B_1 \oplus_R 0^{R+C}),\\ {X_1} = \lfloor S_1 \rfloor_L \oplus V,\\ {S_2} = F(B_2 \oplus_R S_1),\\ {X_2} = \lfloor S_2 \rfloor_L \oplus X_1,\\ {S_3} = F(B_3 \oplus_R S_2),\\ {X_3} = \lfloor S_3 \rfloor_L \oplus X_2,\\ \ldots,\\ {S_N} = F(B_N \oplus_R S_{N-1}),\\ {X_N} = \lfloor S_N \rfloor_L \oplus X_{N-1}.\\ \end{array}$$

Then $X_N$ is the hash of $M$.

Is this modified construction cryptographically weaker than the standard sponge construction? If yes (or no), then why?


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.