I am trying to understand the sponge construction, and in the official web site I found this sentence:

The last c bits of the state are never directly affected by the input blocks and are never output during the squeezing phase.

Now I understood that the capacity is used to hide the internal state to an attacker. But I can not understand two aspects:

  1. How is the capacity filled?
  2. If it is part of the internal state, how can be possible that is not affected by the input blocks?

1 Answer 1


The capacity $c$, together with the rate $r$, is the state of the algorithm between the applications of the sponge.

It is of course affected by the message (there is no other input after all) but not directly: the input first has to go through the sponge function, $f$, after it is XOR'red with the rate, $r$. Similarly, only the rate $r$ is output during the squeezing. So the previous capacity $c$ is similarly protected by a sponge. Note that there is always an $f$ between the input and output (of course).

The capacity and the rate are first initialized to zero.

enter image description here


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.