The Making of K<scp>ECCAK</scp>

Abstract

Abstract The sponge function KECCAK is the versatile successor of SHA-1 and the SHA-2 series of hash functions. Its structure and components are quite different from its predecessors, and at first sight it seems like a complete break with the past. In this article, researchers show that KECCAK is the endpoint of a long learning process involving many intermediate designs, mostly gradual changes, but also some drastic changes of direction. Researchers take off from their attempts at fixing PANAMA [26 Daemen , J. and C. S . K. Clapp . 1998 . In Fast Hashing and Stream Encryption with PANAMA . Fast Software Encryption, edited by S. Vaudenay . LNCS, no. 1372 , Springer-Verlag , pp. 60 – 74 . [Google Scholar]], resulting in RADIOGATÚN [4 Bertoni , G. , J. Daemen , M. Peeters , and G. Van Assche . August 2006 . RADIOGATÚN, A Belt-and-Mill Hash Function: Second Cryptographic Hash Workshop, Santa Barbara, http://radiogatun.noekeon.org/ . [Google Scholar]], and their insights on trail backtracking applied to generalizations of PANAMA and RADIOGATÚN, known as alternating-input and belt-and-mill structures. They explain how they originally proposed the sponge construction to compactly express security claims for their designs and how they finally decided to use it in an actual design which would become KECCAK. Then, they explain the design choices made in KECCAK and how some of its building blocks can be traced back to its predecessor, RADIOGATÚN, and even earlier.