Skip to main content
Cryptography

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

5
  • 1
    $\begingroup$ For sponges in particular, distinguishing the rate part from random certainly works. However, there seems to be general claims like "this paper broke N rounds of Gimli" that are independent from the sponge construction. I looked at these papers but they don't seem to be using some common definition for what is "broken"... $\endgroup$ Commented Oct 24, 2025 at 20:27
  • $\begingroup$ @user1641237 It appears that for certain input, some part of the output can be predicted without knowing the full input, or have certain pattern. See inria.hal.science/hal-03045986/document#page=10 $\endgroup$ Commented Oct 25, 2025 at 2:37
  • $\begingroup$ In what world is Keccak a permutation? Or sponges in general? See en.wikipedia.org/wiki/Permutation . It's contorting the language, like saying AES is a permutation which is clearly isn't. $\endgroup$ Commented Oct 25, 2025 at 15:14
  • $\begingroup$ @PaulUszak While Keccak the hash function isn't a permutation, the building block Keccak-f[1600] is one. Keccak then instantiates the sponge constructiong using Keccak-f[1600] as the "stirring the entropy pool" permutation. $\endgroup$ Commented Oct 25, 2025 at 17:09
  • $\begingroup$ @user1641237 Hmm, struggling to see how XOR and LFSR injection is a permutation. $\endgroup$ Commented Oct 26, 2025 at 21:56