Guido Bertoni3, Joan Daemen2, Seth Hoffert, Michaël Peeters1, Gilles Van Assche1 and Ronny Van Keer1
1STMicroelectronics - 2Radboud University - 3Security Pattern
Keccak-p designates a set of cryptographic permutations. Defined in the the Keccak reference and standardized in FIPS 202, these permutations are at the core of Keccak, Ketje, Keyak, KangarooTwelve and Kravatte.
| Synopsis | The Keccak-p permutations |
|---|---|
| Designed by | Guido Bertoni, Joan Daemen, Michaël Peeters and Gilles Van Assche |
| Parameterized by | The width b and the number of rounds nr |
| Instances | The instances are denoted Keccak-p[b, nr]. The width b must be 25, 50, 100, 200, 400, 800 or 1600 bits. Some instances can also be equivalently denoted Keccak-f[b], as listed in the table below. |
We refer to the FIPS 202 standard for a formal definition. The interested reader can also find a pseudo-code description as a quick introduction.
The permutations at the core of Keccak were initially called Keccak-f and had a fixed number of rounds. As third-party cryptanalysis advanced, we started defining permutations with a lower round count to improve performance without compromising security, and this gave rise to the definition of Keccak-p as a superset of Keccak-f. In other words, the Keccak-f permutations are Keccak-p permutations with a specific number of rounds.
The Keccak-p permutations coincide with the Keccak-f permutations on the last round. For instance, Keccak-p[1600, 12] consist of the last 12 rounds of Keccak-f[1600] = Keccak-p[1600, 24].
The following table lists the Keccak-f permutations.
| Keccak-f[b] instance | Equivalent Keccak-p[b, nr] instance |
|---|---|
| Keccak-f[1600] | Keccak-p[1600, 24] |
| Keccak-f[800] | Keccak-p[800, 22] |
| Keccak-f[400] | Keccak-p[400, 20] |
| Keccak-f[200] | Keccak-p[200, 18] |
| Keccak-f[100] | Keccak-p[100, 16] |
| Keccak-f[50] | Keccak-p[50, 14] |
| Keccak-f[25] | Keccak-p[25, 12] |