# rotation offsets for KECCAK-$f$

So let's say you're trying to do SHA3-224.

If you're on a 64-bit machine you'd presumably use KECCAK-$f$. In-so-far as I understand it'd have the following parameters:

With a 32-bit machine you'd presumably be using KECCAK-$f$ with the following parameters (last table):

• Rate: 448 (2*224)
• Capacity: 352 (800 - rate)
• Rounds: 22 ($12 + 2*\log_2(800/25)$)

Assuming that that's all correct then what I'm wondering about is how the rotation constants would work.

https://keccak.team/files/Keccak-reference-3.0.pdf#page=21 gives a formula for determining the rotation constants: $(t+1)(t+2)/2$ and https://keccak.team/files/Keccak-reference-3.0.pdf#page=22 shows a table with the results of the formula. To get the rotation constants at https://keccak.team/keccak_specs_summary.html you take the lower lower six bits of each of those numbers (eg. $x \land 0x3F$ or $x \mod 64$).

For KECCAK-$f$ would you take the lower five bits (eg. $x \land 0x1F$ or $x \mod 32$) of each of those numbers?

A lot of the 32-bit SHA3 implementations I've seen seem to do KECCAK-$f$ and just simulate 64-bit numbers with 2x 32-bit numbers.

The following two assumptions are mutually incompatible:

you're trying to do SHA3-224

and

with a 32-bit machine you'd presumably be using KECCAK-f

because chapter 6.1 of the SHA-3 Standard FIPS PUB 202 (the link can be found here) defines

$\text{SHA3-224}(M) = \text{Keccak}(M \mathbin\Vert 01, 224)$,

but chapter 2.4 of this Standard defines that

$\text{Keccak}[c]$ is the Keccak instance with $\text{Keccak-}f$ as the underlying permutation and capacity $c$.

Regarding the question about the rotation offsets for $\text{Keccak-}f$ — see chapter 3.2.2 of the SHA-3 Standard FIPS PUB 202 and note that $w=32$. For example, I have seen both the algorithm and the precomputed offsets here:

• Chapter 3.2.2 talks about $w = 8$. Why talk about any $w$ other than $64$ if only $\text{Keccak-}f$ (with $w = 64$) is used? – neubert Aug 7 '18 at 13:51
• @neubert: Because SHA-3 function is derived from Keccak, so Keccak is defined before SHA-3 function specifications. Chapter 3.2.2 contains an illustration of RHO for the case $w = 8$ in Figure 4, but Algorithm 2 is defined for all possible values of $w$. See Table 1 in chapter 3.1. But SHA-3 function specifications are given in chapter 6 of this Standard. The width of the underlying permutation of SHA-3 is 1600 bits, which corresponds to $w = 64$. – lyrically wicked Aug 8 '18 at 4:23