Skip to main content
1 of 3
fgrieu
  • 145.4k
  • 12
  • 319
  • 611

With padding removed and all messages multiple of the rate, Keccak (or a generic sponge-constructed hash) is believed collision-resistant. However it has one undesirable property: the empty message hashes to all-zero.

Padding of sponge functions is constructed on top of that, so that

  • All padded messages are a multiple of the rate.
  • Two distinct messages yield different padded messages,for collision resistance.
  • No padded messages is empty, so that it's hard to find a preimage of all-zero.

Further, the padding of the SHA-3 functions is such that two distinct (message, function) pairs yield different padded messages. That makes it hard to find $M$, $M'$ with $\operatorname{SHA3-256}(M)=\operatorname{SHAKE256}(M',256)$. or such that $\operatorname{SHA3-224}(M)$ is the first 28 bytes of $\operatorname{SHA3-256}(M')$.

fgrieu
  • 145.4k
  • 12
  • 319
  • 611