2022 Developer Survey is open! Take survey.

Hot answers tagged

20 votes

Why is SHA-3 a Sponge function?

… SHA3 (Bouncycastle) constrains me … Bouncycastle offers the NIST approved, fixed, and standardized output lengths of the keccak sponge function. See, when talking about SHA-3, you're talking about ...
user avatar
  • 17.4k
11 votes

Why is SHA-3 a Sponge function?

SHA-3 is a subset of the Keccak family, which defines a different hash function for all valid combinations of parameters $d$ (output size), $r$ (rate), and $c$ (capacity). SHA-3 defines only these ...
user avatar
  • 2,081
9 votes
Accepted

Is a strong block cipher usable as a strong sponge function?

I believe that, in this specific case, you are correct; it would appear to take $2^{60}$ effort to find a collision in the above function. On the other hand, there is one nit with this approach: this ...
user avatar
  • 131k
9 votes

Where did the SHAKEs come from in SHA3?

Where did SHAKE128 and SHAKE256 originate from? They follow from the general properties of the sponge construction. A sponge function can generate an arbitrary length of output. The submission of ...
user avatar
  • 31.2k
9 votes
Accepted

Different padding rules for Merkle–Damgård and Keccak/sponge function

Actually, the Merkle–Damgård construction also specifies a padding bit after the message. The length is there the ensure that a padded message cannot be the suffix of a different longer message. A ...
user avatar
  • 12.6k
9 votes
Accepted

What is the importance of the $r$ and $c$ values for the Sponge Construction?

Keccak is Sponge-based hash function: [Image taken from the official sponge page] It has a large internal state, and iterates this with a permutation (that for theoretical proofs we model as an ...
user avatar
8 votes
Accepted

security of a sponge construction

The capacity of the sponge construction refers to the section of the state that is not revealed to the adversary. By effectively zeroing/truncating one side of the output of a permutation, it becomes ...
user avatar
  • 19.2k
8 votes

What security do Cryptographic Sponges offer against generic quantum attacks?

Fix a hash function $H\colon \{0,1\}^m \to \{0,1\}^n$ built out of a sponge of capacity $c$. To raise the cost of both generic collision and generic preimage searches on classical or quantum ...
user avatar
8 votes

How does KECCAK operate on a state array filled with zeros?

I personally find the Keccak.team Psuedo Code document very helpful to understand how Keccak-p works. As DannyNiu said in the comments, most (all?) cryptographic permutation employ "round ...
user avatar
7 votes
Accepted

Security analysis of Spritz?

I have looked at some attacks on RC4 and be curious if some of them can be applied to Spritz as well. Does anybody else has analysed Spritz so far? Or is it far too early for results against Spritz? ...
user avatar
  • 31.2k
6 votes

How does the sponge construction avoid the weaknesses present in Merkle–Damgård hash function?

There's two ways to answer this. One would be to go over the individual M-D weaknesses you list and show why the sponge construction is resistant to them. For example, if you consider length ...
user avatar
6 votes
Accepted

What's the proper choice for the block size of a sponge-based hash?

The "block size" matters for Merkle-Damgård functions because the HMAC security proof relies on that block size. For other functions, and in particular sponge functions, the block size for HMAC is ...
user avatar
6 votes

Can we exchange the permutation of a sponge construction?

The permutation should be as close to a random permutation as possible. This is essentially a block-cipher with a fixed key. A random permutation with given width $b$ is a permutation drawn ...
user avatar
6 votes
Accepted

Can we exchange the permutation of a sponge construction?

The security of the sponge construction rely on two parts: the size of the capacity. and the strength of the permutation used in the construction. This permutation is expected to have at least the ...
user avatar
  • 9,789
6 votes

What is the sponge construction in simple terms?

I find that the following image from Wikipedia, though perhaps a bit too technical for your purposes, is still helpful with a little explanation: Essentially, a function $f$ is used repeatedly in two ...
user avatar
5 votes

Security analysis of Spritz?

Unfortunately, there’s bad news. According to Wikipedia, it’s alledgedly been broken; this paper appears to have details, but I prefer being a programmer, not an academic. The summary of it boils ...
user avatar
  • 273
5 votes
Accepted

How should I treat a new cipher release like Spritz?

Nobody can tell you not to "have fun with it" but I would strongly recommend you to first study attacks on other ciphers. Spritz (Rivest & Schuldt) fortunately mentions a lot of research on its ...
user avatar
  • 84.7k
5 votes

Usage and limitations of sponge functions for PRNG

I'd say the comparison table is not a fair one, as it compares the Infinite Noise generator's throughput when feeding bits into a CSPRNG (Keccak) running on the host workstation and then running that ...
user avatar
  • 2,217
5 votes
Accepted

Intuition for SHA3 sponge construction

So if it's just a permutation of 0s and 1s as we've concluded, what is hard about finding an alternate message string that satisfies the constrains I've mentioned on the permutation outcome? To be ...
user avatar
  • 19.2k
5 votes
Accepted

Why HAIFA and sponge constructions are not prone to length extension attacks?

Sponge Construction In sponge construction, the block size $b$ has two parts, $r$ is the rate and it is the written part and $c$ capacity is the untouched part by the input/output, $b= c+r$ The ...
user avatar
  • 43.1k
4 votes

Different padding rules for Merkle–Damgård and Keccak/sponge function

Isn't it still possible to find two different inputs that will be padded to the same value and then deliver the same hash? Well, no, it isn't. Given a padded message (that is, padded by adding a 1 ...
user avatar
  • 131k
4 votes
Accepted

help with cryptanalysis of a sponge permutation

I don't think there is a way to check the period of such a sequence without actually computing it. That being said, having a long period like that is not desirable in cryptography. A psuedorandom ...
user avatar
  • 19.2k
4 votes

What's the proper choice for the block size of a sponge-based hash?

Iterated hashes generally accumulate a fixed amount of data and then call a compression function (or a permutation in the case of sponges) on this data together with a chaining-value. The block size ...
user avatar
4 votes
Accepted

NORX duplex padding

MonkeyDuplex in NORX does not have padding per duplex because it does not need thanks to domain separation. As the plaintext is mixed into the ciphertext, it does so at the sponge rate, the same way ...
user avatar
  • 12.6k
4 votes

Merkle trees instead of the Sponge or the Merkle-Damgård constructions for the design of cryptorgraphic hash functions

Is there any reason why don't more cryptographic hash functions use a Merkle tree-like construction directly instead of just adding them as a way to allow parallelism to existing hash functions on ...
user avatar
  • 129
4 votes
Accepted

How is a sponge construction better than cycling the output of a hash back to the input?

why not have $r$ be the whole block? Because you'd essentially have no security. In the absorbing phase, the attacker could set the intermediate state to whatever he wants. For example, if the ...
user avatar
  • 131k
4 votes
Accepted

Usage and limitations of sponge functions for PRNG

The only reason to use /dev/random is to wait until the system has loaded entropy. If you have waited once, it is generally safe to use /dev/urandom. It has nothing whatsoever to do with speed of ...
user avatar
4 votes
Accepted

Capacity bits in SHA-3

The capacity $c$, together with the rate $r$, is the state of the algorithm between the applications of the sponge. It is of course affected by the message (there is no other input after all) but not ...
user avatar
  • 84.7k
4 votes

SHA-3 Step by step?

You can find the pseudocode from the authors on their website. Additionally, the authors have written a compact and readable reference implementation in C which has been uploaded to GitHub here. If ...
user avatar
  • 12.9k
4 votes

Rationale for NORX/Ketje/Keyak not being chosen for the CAESAR final portfolio

This is an interesting question , here are some main points to identify major differences between Caesar winners and above-mentioned algorithm Background Norx is LRX- Duplex based authenticated ...
user avatar
  • 1,980

Only top scored, non community-wiki answers of a minimum length are eligible