# Is it possible to apply a pseudo-random permutation (a keyed permutation) to construct a sponge function?

The description of the sponge function on Crypto.Stackexchange contains the following text (source):

The cryptographic sponge is a construction scheme for hash functions (and other symmetric primitives) based on an unkeyed permutation.

But is it possible to make use of a keyed permutation $$f_k(x)$$ to construct the sponge function? All constructions described in the “One-way compression function” article on Wikipedia are based on the keyed permutation function. And section “Sponge construction” of this article contains the following information:

The sponge construction can be used to build one-way compression functions.

But the article “Sponge function” does not mention any presence of the key in the used permutation function $$f(x)$$. Does this imply that we can fix any public key $$K$$ and always use $$f_K(x)$$ as $$f(x)$$? If yes, then how does the length of $$K$$ impact the security of the $$n$$-bit output, assuming that $$n$$ will be equal to the capacity divided by 2, as in SHA-3 (but if $$K$$ is public, then it seems that its length should not impact the security at all!)? If no, then how to apply a pseudo-random permutation (that is, a keyed permutation function) $$f_k(x)$$ to construct a sponge function, and how will the length of $$k$$ impact the security of the $$n$$-bit output?

• The value of the key shouldn't matter (so public fixed key should be fine). But the problem with most (practical) keyed permutations is rather that they only operate on eg 128 bit (with the largest non-composite one I know being Threefish-1024) and for comparison: Keccak / SHA3 uses a 1600 bit permutation. – SEJPM Nov 10 '18 at 18:03
• @SEJPM: There exists XXTEA, which supports variable block length. Although there are attacks against XXTEA, it is possible to increase the number of rounds, thus increasing the difficulty of these attacks. – lyrically wicked Nov 12 '18 at 6:12