Guido Bertoni^{3}, Joan Daemen^{2}, Seth Hoffert, Michaël Peeters^{1}, Gilles Van Assche^{1} and Ronny Van Keer^{1}

^{1}STMicroelectronics - ^{2}Radboud University - ^{3}Security Pattern

Keccak-*p* designates a set of cryptographic permutations.
Defined in the the Keccak reference and standardized in FIPS 202, these permutations are at the core of Keccak, Ketje, Keyak, KangarooTwelve and Kravatte.

Synopsis | The Keccak-p permutations |
---|---|

Designed by | Guido Bertoni, Joan Daemen, Michaël Peeters and Gilles Van Assche |

Parameterized by | The width b and the number of rounds n_{r} |

Instances | The instances are denoted Keccak-p[b, n_{r}]. The width b must be 25, 50, 100, 200, 400, 800 or 1600 bits. Some instances can also be equivalently denoted Keccak-f[b], as listed in the table below. |

We refer to the FIPS 202 standard for a formal definition.
The interested reader can also find a *pseudo-code* description as a quick introduction.

The permutations at the core of Keccak were initially called Keccak-*f* and had a fixed number of rounds.
As third-party cryptanalysis advanced, we started defining permutations with a lower round count to improve performance without compromising security, and this gave rise to the definition of Keccak-*p* as a superset of Keccak-*f*.
In other words, the Keccak-*f* permutations are Keccak-*p* permutations with a specific number of rounds.

The Keccak-*p* permutations coincide with the Keccak-*f* permutations on the last round.
For instance, Keccak-*p*[1600, 12] consist of the last 12 rounds of Keccak-*f*[1600] = Keccak-*p*[1600, 24].

The following table lists the Keccak-*f* permutations.

Keccak-f[b] instance | Equivalent Keccak-p[b, n_{r}] instance |
---|---|

Keccak-f[1600] | Keccak-p[1600, 24] |

Keccak-f[800] | Keccak-p[800, 22] |

Keccak-f[400] | Keccak-p[400, 20] |

Keccak-f[200] | Keccak-p[200, 18] |

Keccak-f[100] | Keccak-p[100, 16] |

Keccak-f[50] | Keccak-p[50, 14] |

Keccak-f[25] | Keccak-p[25, 12] |