Keccak

1 The algorithm

Author(s): Guido Bertoni, Joan Daemen, Michaël Peeters and Gilles Van Assche
Website: http://keccak.noekeon.org/
NIST submission package:
- round 1: Keccak.zip
- round 2: Keccak_Round2.zip

G. Bertoni, J. Daemen, M. Peeters, G. Van Assche - Keccak specifications

,2009

http://keccak.noekeon.org/Keccak-specifications-2.pdf
Bibtex

Author : G. Bertoni, J. Daemen, M. Peeters, G. Van Assche
Title : Keccak specifications
In : -
Address :
Date : 2009

G. Bertoni, J. Daemen, M. Peeters, G. Van Assche - Keccak sponge function family main document

,2009

http://keccak.noekeon.org/Keccak-main-2.0.pdf
Bibtex

Author : G. Bertoni, J. Daemen, M. Peeters, G. Van Assche
Title : Keccak sponge function family main document
In : -
Address :
Date : 2009

G. Bertoni, J. Daemen, M. Peeters, G. Van Assche - Keccak specifications

,2008

http://keccak.noekeon.org/Keccak-specifications.pdf
Bibtex

Author : G. Bertoni, J. Daemen, M. Peeters, G. Van Assche
Title : Keccak specifications
In : -
Address :
Date : 2008

G. Bertoni, J. Daemen, M. Peeters, G. Van Assche - Keccak sponge function family main document

,2008

http://keccak.noekeon.org/Keccak-main-1.0.pdf
Bibtex

Author : G. Bertoni, J. Daemen, M. Peeters, G. Van Assche
Title : Keccak sponge function family main document
In : -
Address :
Date : 2008

2 Cryptanalysis

We distinguish between two cases: results on the complete hash function, and results on underlying building blocks.

A description of the tables is given here.

Recommended security parameter: 24 rounds (Keccak-f [1600])

2.1 Hash function

Here we list results on the hash function according to the NIST requirements. The only allowed modification is to change the security parameter.

Type of Analysis	Hash Size (n)	Parameters	Compression Function Calls	Memory Requirements	Reference

2.2 Building blocks

Here we list results on underlying building blocks, and the hash function modified by other means than the security parameter.

Note that these results assume more direct control or access over some internal variables (aka. free-start, pseudo, compression function, block cipher, or permutation attacks).

Type of Analysis	Hash Function Part	Hash Size (n)	Parameters/Variants	Compression Function Calls	Memory Requirements	Reference
preimage⁽²⁾	hash	1024	3 rounds, 40 bit message	1852 seconds (2^34.11)	?	Morawiecki,Srebrny
distinguisher⁽¹⁾	permutation	all	18 rounds	2¹³⁷⁰		Boura,Canteaut
distinguisher⁽¹⁾	permutation	all	16 rounds	2^1023.88		Aumasson,Meier
key recovery	secret-prefix MAC	224	4 rounds	2¹⁹	?	Lathrop
observations	permutation	all				Aumasson,Khovratovich

⁽¹⁾The Keccak team commented on these distinguishers and provide generic constructions in this note.

⁽²⁾The Keccak team estimated the complexity of this attack with 2^34.11 evaluations of 3-rounds of Keccak-f[1600] in this note (exhaustive search: 2⁴⁰).

Pawel Morawiecki, Marian Srebrny - A SAT-based preimage analysis of reduced KECCAK hash functions

,2010

http://eprint.iacr.org/2010/285.pdf
Bibtex

Author : Pawel Morawiecki, Marian Srebrny
Title : A SAT-based preimage analysis of reduced KECCAK hash functions
In : -
Address :
Date : 2010

G. Bertoni, J. Daemen, M. Peeters, G. Van Assche - Note on zero-sum distinguishers of Keccak-f

,2010

http://keccak.noekeon.org/NoteZeroSum.pdf
Bibtex

Author : G. Bertoni, J. Daemen, M. Peeters, G. Van Assche
Title : Note on zero-sum distinguishers of Keccak-f
In : -
Address :
Date : 2010

Christina Boura, Anne Canteaut - A Zero-Sum property for the Keccak-f Permutation with 18 Rounds

,2010

http://www-roc.inria.fr/secret/Anne.Canteaut/Publications/zero_sum.pdf
Bibtex

Author : Christina Boura, Anne Canteaut
Title : A Zero-Sum property for the Keccak-f Permutation with 18 Rounds
In : -
Address :
Date : 2010