On the Indifferentiability of the Sponge Construction

Abstract. In this paper we prove that the sponge construction introduced in [4] is indifferentiable from a random oracle when being used with a random transformation or a random permutation and discuss its implications. To our knowledge, this is the first time indifferentiability has been shown for a construction calling a random permutation (instead of an ideal compression function or ideal block cipher) and for a construction generating outputs of any length (instead of a fixed length).

• Type: Conference
• Year: 2008
• Where: EUROCRYPT
• Authors: Guido Bertoni, Joan Daemen, Michael Peeters, Gilles Van Assche
• Keywords: Cryptology, EUROCRYPT 2008, Random Oracle, Random Permutation, Random Transformation