Keccak - as used in SHA-3 / SHAKE amongst others - can also be used for authenticated encryption.

However, there already seem multiple schemes defined for it, including their own implementations:

  1. Ketje:

    1. Kejte Jr;
    2. Kejte Sr;
    3. Kejte Minor and
    4. Kejte Major
  2. Kravatte (excluding the deprecated/broken schemes):

    1. Kravatte-SANE and
    2. Kravatte-SANSE (SIV)
  3. Keyak:

    1. River Keyak;
    2. Lake Keyak;
    3. Sea Keyak;
    4. Ocean Keyak and
    5. Lunar Keyak.
  4. Motorist (based on Keyak, same paper)

So why are there so many different authentication schemes, how do they differ? Kravatte is part of an embedded framework that provides a single function for everything, but there seems to be no explanation why Ketje exists next to Keyak, or why Motorist doesn't completely replace Keyak.

Are there any objective reasons to choose one over the other? Which one, for instance, would be a good generic AEAD scheme to use together with a PQC KEM?

  • $\begingroup$ If the last part of my question is too much please indicate. $\endgroup$
    – Maarten Bodewes
    Commented Jul 13, 2021 at 10:04


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.