3

Keccak defines a family of hash functions, by building a sponge out of a permutation Keccak-$f[b]: \{0,1\}^b \rightarrow \{0,1\}^b$. This permutation function is parametrised using $b$, which is the string length of the permuted block.

Keccak-$f[b]$'s block is further divided in $5\times 5$ "words" or "lanes" of length $w$, such that $b=25w$. The Keccak specification summary defines Keccak only for $w\in\{1,2,4,8,16,32,64\}$ or equivalently $b\in\{25,50,100,200,400,800,1600\}$. Typically, $b$ is chosen $1600$ (equivalently, $w=64$).

This makes me wonder: what applications have the authors in mind for small $b$ values? I can imagine a sponge construction for e.g. $b<400$ can become insecure, although these permutation functions are explicitly defined.

One example I could find was the Ketje Jr AEAD, which still uses $w=8$.

Ruben De Smet
  • 2,370
  • 11
  • 26

0 Answers0