# What does the minimal number of round of “nr” use Keccak to avoid “collision attack”?

What does the minimal number of round of "nr" use Keccak to avoid collision attack?

$$nr = 12+2L$$

• Welcome to Cryptography. I've edited your question. Please check, there are still some points. The Collision attack is inevitable. You should give a probability bound to achieve. See the birthday attack or Sweet32 – kelalaka Mar 10 '19 at 14:33
• @kelalaka How is sweet32 relevant? There are standard costs widely understood to be unachievable; when a collision attack on a widely used unkeyed hash function at a reasonable length is achievable once it is usually bad news for everyone, so there's not much sense in asking about specific probability bounds in this context. – Squeamish Ossifrage Mar 10 '19 at 15:08

## 1 Answer

Cursory literature search suggests that the best collision attacks reach only six rounds of Keccak:

• Kexin Qiao, Ling Song, Meicheng Liu, and Jian Guo, ‘New Collision Attacks on Round-Reduced Keccak’, in Jean-Sébastien Coron and Jesper Buus Nielsen, eds., Advances in Cryptology—EUROCRYPT 2017, April 2017, Springer LNCS 10212, pp. 217–243 (link, preprint)
• Ling Song, Guohong Liao, and Jian Guo, ‘Non-full Sbox Linearization: Applications to Collision Attacks on Round-Reduced Keccak’, in Jonathan Katz and Hovav Shacham, eds., Advances in Cryptology—CRYPTO 2017, Part II, Springer LNCS 10402, August 2017, pp. 428–45 (link, preprint)

Of course, attacks only get better, so it would be imprudent to choose six rounds. This state of affairs justified the use of a mere twelve rounds in KangarooTwelve at substantial speed increase over the twenty-four used by SHA-3.