The Keccak-p permutations

Keccak-p designates a set of cryptographic permutations. Defined in the the Keccak reference and standardized in FIPS 202, these permutations are at the core of Keccak, Ketje, Keyak, KangarooTwelve and Kravatte.

Technical details

SynopsisThe Keccak-p permutations
Designed byGuido Bertoni, Joan Daemen, Michaël Peeters and Gilles Van Assche
Parameterized byThe width b and the number of rounds nr
InstancesThe instances are denoted Keccak-p[b, nr]. The width b must be 25, 50, 100, 200, 400, 800 or 1600 bits. Some instances can also be equivalently denoted Keccak-f[b], as listed in the table below.

We refer to the FIPS 202 standard for a formal definition. The interested reader can also find a pseudo-code description as a quick introduction.

Keccak-p vs Keccak-f

The permutations at the core of Keccak were initially called Keccak-f and had a fixed number of rounds. As third-party cryptanalysis advanced, we started defining permutations with a lower round count to improve performance without compromising security, and this gave rise to the definition of Keccak-p as a superset of Keccak-f. In other words, the Keccak-f permutations are Keccak-p permutations with a specific number of rounds.

The Keccak-p permutations coincide with the Keccak-f permutations on the last round. For instance, Keccak-p[1600, 12] consist of the last 12 rounds of Keccak-f[1600] = Keccak-p[1600, 24].

The following table lists the Keccak-f permutations.

Keccak-f[b] instanceEquivalent Keccak-p[b, nr] instance
Keccak-f[1600]Keccak-p[1600, 24]
Keccak-f[800]Keccak-p[800, 22]
Keccak-f[400]Keccak-p[400, 20]
Keccak-f[200]Keccak-p[200, 18]
Keccak-f[100]Keccak-p[100, 16]
Keccak-f[50]Keccak-p[50, 14]
Keccak-f[25]Keccak-p[25, 12]