Notes on cryptography and information theory

SHA-3 and the Keccak sponge construction

Entry 008 · 2026-05-02

The SHA-3 competition was launched in 2007 as a hedge against sudden collapse of SHA-2 — by analogy to what had happened to MD5 and what was beginning to happen to SHA-1. The competition closed in 2012 with the selection of Keccak, designed by Bertoni, Daemen, Peeters, and Van Assche. The two big differences from SHA-2 are the structural one — Keccak is a sponge function, not a Merkle–Damgård construction — and the operational one — Keccak uses bit-level permutations rather than byte-level word operations.

A sponge has a large internal state (1600 bits in Keccak), of which some bits are "rate" and the rest are "capacity". Input is absorbed by XORing it into the rate portion and then applying a permutation; output is extracted from the rate portion, with the permutation applied between extractions. The security argument is conditional on the indistinguishability of the permutation from a random one, and the indistinguishability of the sponge construction itself has tight provable bounds tied to the capacity.

The structural change matters for use beyond hashing. A sponge can produce arbitrary-length output (Keccak as XOF — extendable output function — is part of the SHA-3 standard) and can be parameterized to act as a stream cipher or as a MAC. SHA-2 cannot do these things directly; it has a fixed output length and a Merkle–Damgård length-extension property that has to be patched in deployment (HMAC, the standard MAC built from SHA-2, exists to work around the length-extension issue).

Adoption has been slow. SHA-2 is still everywhere because nothing forced an upgrade; SHA-2 has not broken. Where SHA-3 has gained ground is in newer ecosystems built from scratch (Ethereum hashes blocks with Keccak-256, slightly modified from the standardized version) and in specific protocols where the sponge's flexibility was useful from the start.