# What is the sponge construction in simple terms?

I suggested to my client to use SHA3 instead of SHA2. I know that SHA3 is based on Keccak algorithm which won the NIST's competition.

I want to explain the structure of sponge functions in very simple terms; does anybody have a simple explanation of cryptographic sponges?

• The keccak team have a website, and they kind of have a summary for the sponge construction in this link. – Hinton Zsh Aug 6 at 14:10
• @NezarAboGhanem A period sneaked into you link so I get a 404. This should work. – thesquaregroot Aug 6 at 14:24
• Sorry, I didn't realize that. @thesquaregroot thank you for providing the right link. – Hinton Zsh Aug 6 at 14:27

I find that the following image from Wikipedia, though too perhaps a bit too technical for your purposes, is still helpful with a little explanation:

Essentially, a function $$f$$ is used repeatedly in two phases, absorbing and squeezing.

In the absorbing phase, small chunks of the input data are mixed into the beginning of the buffer using XORs (using the variables from the image, $$r \oplus P_i$$). This updated buffer value is then passed through $$f$$ and the process continues. With each step a small amount of input date (the bit-length of $$r$$) is "absorbed" into the buffer using $$f$$ to semi-randomize the entire buffer.

In the squeezing phase, the same process is repeated but instead of XOR-ing the first $$r$$ bits with data, they are extracted as the next $$r$$ bits of the output.

tl;dr: The input is mixed into a buffer in small chucks in between phases where a buffer is randomized, then the buffer is randomized repeatedly while small chucks of it are taken as output.

It feels worth calling out that your purposes for recommending SHA-3 over SHA-2 may be more important. Does their application of SHA-2 suffer from the possibility of length-extension attacks? Are there other benefits of SHA-3 that you could benefit from? As mentioned here the situation isn't really "move to SHA-3 because it's a better version of SHA-2."

It's possible you're already aware of this but you client may not be. As such, a simple description of how it works may not really be all they need, even if that's all they're asking for.