Using NIST constructions based on Keccak like cSHAKE128 for other sponges

Question

NIST defines a lot of interesting applications of sponges in FIPS 202 and NIST SP 800-185 like the XOF cSHAKE128 or the MAC scheme KMAC.

All this schemes come with a security guarantee and are explicitly based on a sponge using Keccak as its permutation.

This leads me to two questions:

Do these constructions really rely on Keccak (apart from minor technical details like the padding length) or can they be adapted to different sponges without loosing security (assuming the alternative sponge function used is secure enough, of course)?
Are there any papers or standards published, which propose similar constructions which are not dependent on a single sponge instance?

No, the constructions don't inherently depend on the permutation chosen. You could easily replace Kecccak with a reduced-round version or with eg Gimli. — SEJPM, Sep 07 '17 at 09:54
@SEJPM Maybe also mention that Gimli cryptanalysis shows that creating a good $f$ function is not an easy thing to do… even for professionals. — e-sushi, Sep 07 '17 at 12:20
@e-sushi I do not intend to invent my own permutation function. I just want to research, how careful I have to be in using an established sponge. — mat, Sep 07 '17 at 12:25
Related: Can we exchange the permutation of a sponge construction? — e-sushi, Sep 07 '17 at 12:25
@mat Always double check the work if you're able to specify an output length that is larger than the state size. — Q-Club, Sep 07 '17 at 22:09
Possible duplicate of Can we exchange the permutation of a sponge construction? — Squeamish Ossifrage, Mar 09 '19 at 16:41
I don't think this is really a duplicate. This asks if another sponge can be swapped in, not another permutation. I don't think it's trivially answered by the other. — otus, Mar 10 '19 at 15:05
@otus What is the difference between swapping in another sponge and swapping in another permutation? The only parameter a sponge has besides the permutation is the rate/capacity. — Squeamish Ossifrage, Mar 16 '19 at 05:02
@SqueamishOssifrage, a sponge function doesn't even necessarily have to use a permutation, does it? — otus, Mar 21 '19 at 20:21
@otus Technically the syntax of the sponge construction doesn't require it, and there are some theoretical results about uniform random function sponges vs. uniform random permutation sponges, e.g. in the paper introducing sponges, but I've never heard of anyone proposing to actually instantiate the construction with a non-permutation. In any case, it seems to me that replacement of the permutation by a non-permutation would be in the scope of the linked question too, https://crypto.stackexchange.com/q/38050/49826. — Squeamish Ossifrage, Mar 21 '19 at 20:35

Using NIST constructions based on Keccak like cSHAKE128 for other sponges

0 Answers0