The paper The sponge construction as a source of secure cryptographic primitives (see Figure 6) mentions a synchronous sponge mode (working like CTR or OFB modes). So, this type of sponge is a non-authenticated mode. Are there any examples of this type?
Another question: What is the motivation of this type of sponge? As I know, the best reason for using sponges for encryption is to get rid of the need to do Galois multiplication which is slow for IoT devices. Can sponge be as fast as AES-CTR encryption?
Salted hashing
$\endgroup$