Questions tagged [sponge]
The cryptographic sponge is a construction scheme for hash functions (and other symmetric primitives) based on an unkeyed permutation. The most famous example is Keccak, which won the SHA-3 competition.
85 questions
5
votes
1
answer
394
views
Feed-forward connection in sponge construction
In the standard Keccak hash function, the sponge construction is used with Keccak-f permutation as the internal transformation. Since Keccak-f is efficiently invertible, we can walk back the internal ...
- 133
5
votes
1
answer
300
views
What is the security model of a public random permutation?
Security proofs of schemes like the sponge construction assumes that a permutation $P$ is chosen uniformly at random and the attacker is given access to oracles for $P$ and $P^{-1}$. When the sponge ...
- 133
2
votes
1
answer
189
views
Is omitting the first output in the squeezing phase of a sponge a security risk?
I recently saw a specification of a hash function, which is based on a sponge. The hash function produces a $128$ bit message digest $H(X)$.
Let's assume that $S$ is the final state of the absorbing ...
- 168
3
votes
1
answer
130
views
Can the Skein hash function be used to emulate a Duplex function and perform interleaved input & output?
The Skein hash function family defines a hash function that takes a variable length input and can generate a variable length output similar to the way the Sponge construction can.
In both cases, you ...
- 439
2
votes
1
answer
77
views
Building a sponge function from an established permutation
By using a permutation that is already considered secure, can one safely use it to create a secure sponge function? For example, since SHA-512 is considered secure, can the underlying block cipher, ...
- 4,338
1
vote
0
answers
57
views
Advantages, Disadvantages, and Specific Use Cases of Duplex Construction and Tweakable AEAD
I understand the operational mechanisms of Duplex construction and tweakable Authenticated Encryption as used in AEAD schemes. I am interested in a comparative analysis of these cryptographic ...
- 2,318
3
votes
0
answers
107
views
Collision and Second Preimage Resistance for Keyed Sponges?
I was reading the specification for ASCON and I noticed that their claimed security levels for the ASCON hash (derived from the Sponge construction mode used) are as follows:
Let $l$ be the digest ...
- 31
1
vote
1
answer
125
views
Valid use of extendable output functions?
I'm paranoid about new storage devices, since it's a common scam to reprogram a device to lie and report a much larger capacity than it actually has.
I know that there are testing programs ...
- 113
3
votes
1
answer
148
views
Do you need assembler to enhance the performance of your algorithm?
for an IT-Project in school I'm developing a sponge constrction (doesn't have to be secure but it has to mix well) and I'm done implementing it in Python,however it is extremely slow and I don't ...
- 43
0
votes
1
answer
111
views
Can f(S) also be replaced by PRP(S) in a Sponge consruction?
I have difficulties understanding the PRP in the absorb phase of a sponge construction: a block is XORed to the r part of the state memory,and then the entire state sent through a blockcipher-like ...
0
votes
1
answer
110
views
Is this an example of a sponge construction?
I am having difficulties understanding a sponge construction, as I don't really understand whether the long internal state of a sponge construction is compressed in the squeeze phase, or whether bits ...
- 43
3
votes
0
answers
124
views
Preimage resistance of sponge-based hashes and XOFs
In the sponge construction for hash functions, including SHA3 and SHAKE, its used a permutation
$$f:\{0,1\}^r\times\{0,1\}^c\to\{0,1\}^r\times\{0,1\}^c\\
\;\quad(R,C)\quad\quad\mapsto\quad\;(R',C')$$
...
- 151k
2
votes
1
answer
118
views
Oribatida masking question
Why Oribatida uses previous capacity $V_{a+m-1}$ instead of current capacity $V_{a+m}$ for rate masking?
EDIT: I have asked this one of the authors (Arghya Bhattacharjee) and he replied:
Let's say ...
- 1,761
3
votes
0
answers
159
views
Sponge capacity feed-forward
Consider Sponge construction where capacity part of state is feed-forward and xor-ed into next state.
${state}_{i+1} = F({{state}_i}^{rate} || {{state}_i}^{capacity}) \oplus (0^{rate} || {{state}_i}^{...
- 1,761
0
votes
0
answers
117
views
Full-Block Cipher Feedback Mode as a complete AEAD with a free MAC?
Full-State Keyed Sponge (aka Donkey Sponge) appears to cross over into block cipher mode territory such as Full Block Cipher Feedback Mode:
Full State Keyed Sponge (FKS) construction:
FKS has been ...
- 262