This page specifies the challenges, defines the rules and reports on the status of the Keccak Crunchy Crypto Collision and Pre-image Contest.

Summary of the results: The best preimage solution was on 4 rounds and was submitted by Meicheng Liu and Jian Guo in December 2016. The best collision was on 6 rounds and was submitted by Ling Song, Guohong Liao and again Jian Guo in February 2017. Remarkably, the smaller versions are harder to break. Although they have a smaller state, they offer much less degrees of freedom, especially relative to the capacity that is the same for all versions.

Rules

We present challenges for reduced-round Keccak instances, namely Keccak[c=160, r=b-c] with b ≥ 200:

• The capacity is fixed to 160 bits: this implies a security level of 2⁸⁰ against generic collision search.
• The width b of Keccak-f[b] is in {200, 400, 800, 1600}: the width values that support the chosen capacity.
• The number of rounds n_r ranges from 1 to 12.
• The submitter is free to choose the subsequence of consecutive rounds of Keccak-f[b], e.g., the n_r first rounds, the n_r last rounds or n_r rounds starting anywhere. This impacts the values of the round constants in the reduced-round Keccak-f[b].

For each of these Keccak instances there are two challenges:

• generating a collision in the output truncated to 160 bits;
• generating a pre-image of an output truncated to 80 bits.

To be informed of solutions, we suggest all interested people to subscribe to the crypto-competitions -at- googlegroups.com mailing list. Solutions shall be sent to that mailing list with:

• subject "[CRUNCHY CONTEST] n_r rounds, width b, challenge type", with n_r and b having the corresponding values and challenge type either "collision" or "pre-image";
• in the body:
  • names and affiliations of authors;
  • round index of the first round of the reduced-round variant of Keccak-f[b];
  • colliding messages or pre-image in hexadecimal notation;
  • textual summary of how the result was obtained.

The prize money is distributed in the following way:

• There is one prize per challenge.
• For a given challenge, only the first received solution gets a prize.
• The prize for a challenge for n_r rounds is n_r×10 €.

KeccakTools contains support for the validation of solutions (see file KeccakCrunchyContest.cpp ).

Challenges and status

We list below the challenges and the status per number of rounds.

Pre-image challenges

Collision challenges