|Synopsis||The Keccak-p permutations|
|Designed by||Guido Bertoni, Joan Daemen, Michaël Peeters and Gilles Van Assche|
|Parameterized by||The width b and the number of rounds nr|
|Instances||The instances are denoted Keccak-p[b, nr]. The width b must be 25, 50, 100, 200, 400, 800 or 1600 bits. Some instances can also be equivalently denoted Keccak-f[b], as listed in the table below.|
The permutations at the core of Keccak were initially called Keccak-f and had a fixed number of rounds. As third-party cryptanalysis advanced, we started defining permutations with a lower round count to improve performance without compromising security, and this gave rise to the definition of Keccak-p as a superset of Keccak-f. In other words, the Keccak-f permutations are Keccak-p permutations with a specific number of rounds.
The Keccak-p permutations coincide with the Keccak-f permutations on the last round. For instance, Keccak-p[1600, 12] consist of the last 12 rounds of Keccak-f = Keccak-p[1600, 24].
The following table lists the Keccak-f permutations.
|Keccak-f[b] instance||Equivalent Keccak-p[b, nr] instance|