On the Indifferentiability of the Sponge Construction

By Guido Marco Bertoni, Joan Daemen, Michaël Peeters, Gilles Van Assche. International Conference on the Theory and Application of Cryptographic Techniques, 2008

517 citations recorded by the source corpus.

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

spongent: A Lightweight Hash Function (2011, background): “The design of [1] as well as the works [3,4,9] convincingly demonstrate that a permutationbased sponge construction can allow to almost halve the state size for n ≥ c and reasonably small r.”
Quark: A Lightweight Hash (2010, methodology): “In particular it offers a similar security against generic collision attacks and generic second preimage attacks, that is, approximately 2c/2.”
The PHOTON Family of Lightweight Hash Functions (2011, background): “When the internal permutation P is modeled as a randomly chosen permutation, a sponge function has been proven to be indifferentiable from a random oracle [5] up to 2 calls to P .”
Poseidon: A New Hash Function for Zero-Knowledge Proof Systems (2021, background): “A sponge construction [12] builds upon an internal permutation and can be used to achieve various goals such as encryption, authentication, or hashing.”
Ascon v1.2: Lightweight Authenticated Encryption and Hashing (2021, background): “[14] and profits from the extensive literature on sponge functions, particularly the results on its indifferentiability up to about 2c/2 calls to the permutation or its inverse, where c is the capacity in bits [15].”
BLAKE2: Simpler, Smaller, Fast as MD5 (2013, background): “By lowering the capacity from 4n to 2n, where n is the output bit length, one achieves n/2-bit security for both collisions and second preimages [16], but also higher speed.”