I have read this answer on Crypto.SE and I want to clarify a few details.

Does this property of $\text{Keccak-}f[1600](x)$ imply that if we know a particular $1600$-bit output $Y$, it is feasible to find a $1600$-bit input $X$ such that $\text{Keccak-}f[1600](X) = Y$?

If yes, then consider the following situation.

  1. An adversary $A$ has access to the full $1600$-bit state before the final truncation.
  2. The original message $M$ has the length $L$ equal to, say, $552$ bits, and $A$ knows the exact value of $L$.

In this situation, will $A$ be able to find $M$?


1 Answer 1


Keccak-f is a permutation composed of trivially/efficiently invertible building blocks and is therefore itself trivially/efficiently invertible.

If you have the full state you can go backwards. In fact given a message of say, a MAC and the full state at the end you can go backwards and recover the secret key! So you may want to zero out part of the state after pushing your secret key through it in order to make going backwards intractable.

Using Keccak as a CSPRNG has a similar problem, need to periodically zero out a part of the state to defend against state compromise compromising past outputs, especially if there is no reseeding being done.

You can find the inverse operations here: https://github.com/CamMacFarlane/SHA3


This site is temporarily in read-only mode and not accepting new answers.

Not the answer you're looking for? Browse other questions tagged .