# How to interpret a specific mathematical notation in “FIPS 202” (SHA-3 / Keccak)

tl;dr What does "d <= |Z|" mean in the context of bit array manipulations?

As a learning exercise I'm working on an implementation of SHA-3. I am not a cryptography specialist in any way but I have implemented similar algorithms in the past such as MD5 and SHA1, so I am roughly conversant with the kinds of operations that happen in such algorithms.

I have been working through the document "FIPS PUB 202" (freely available as a PDF here: http://dx.doi.org/10.6028/NIST.FIPS.202).

I am finding this a hard document to understand but I'm getting near to completing the program and I'm unsure about the meaning of the following line of text in section 4, algorithm 8 (page 19) the SPONGE function...

My problem is with step 9. I do not understand what "|Z|" means in this context.

This algorithm deals with truncating and concatenating an array Z of bits (which could be several hundred bits long) until this condition is met at which point the first "d" bits of Z is returned to the calling function.

• My first thought was that |Z| means "the length of Z in bits", but that would be inconsistent -- they are using "len(...)" for that purpose in steps 1 and 2 (and elsewhere in the document). This is the only place in the document where this "|...|" notation is used.
• I don't think it would mean "Abs(Z)" in the mathematical sense of converting Z to a positive value because the resulting number would be extremely large in almost all cases. Converting Z (effectively a list of random bits) into an integer seems pointless and arbitrary.
• The "|...|" syntax is not mentioned in the glossary section. ("a || b" is mentioned but that's for array concatenation, which this is definitely not).
• I was also a bit puzzled by the use of "<=" in this condition. Why bother to truncate if the length is equal, just return it as it is? Further suggestion that it doesn't mean "length of Z".

So, how should I understand this slightly weird bit of text? I doubt it's a mistake in the document because it's such an important algorithm and will have been stringently vetted by thousands of people much smarter than me.

• I think it does mean the string length. It’s a common notation for it. If we’d have $=$ the Trunc function does nothing. – Henno Brandsma Oct 2 '19 at 17:33

It means the length of $$Z$$ in bits; in other words, squeeze out consecutive $$r$$-bit blocks from the sponge until you have a $$d$$-bit string, truncating the last block if necessary.
I expect you may overestimate the number of people who proofread this document with an eye for details like that. Most cryptographers studying it will have read the Keccak reference, which uses slightly different notation meaning the same thing; most implementors will likely correctly guess that $$|Z|$$ and $$\operatorname{len}(Z)$$ mean the same thing when $$Z$$ is a bit string, or compare to another reference to confirm.