Sponge Functions

Abstract

A good cryptographic hash function should behave like a random oracle: it should not have weaknesses that a random oracle does not have. Due to the existence of inner collisions, iterated hash functions can never satisfy this ideal. We propose a construction with a finite state called a sponge and show that a random sponge can only be distinguished from a random oracle due to inner collisions. We evaluate the strength of random sponges by computing the probability of success for a number of attacks as a function of their workload and show that these results shed a new light on the classical Merkle-Damgård construction. We propose to use random sponges of given parameters as a reference for specifying security claims for hash functions, but also MAC functions and some types of stream ciphers. The main goal of sponge functions is for designers to be able to formulate a compact security claim.