The Keccak sponge function family

Guido Bertoni¹, Joan Daemen¹, Michaël Peeters² and Gilles Van Assche¹

¹STMicroelectronics

²NXP Semiconductors

Keccak Crunchy Crypto Collision and Pre-image Contest

This page specifies the challenges, defines the rules and reports on the status of the Keccak Crunchy Crypto Collision and Pre-image Contest.

Rules

In total we present challenges for 48 reduced-round Keccak instances, namely Keccak[c=160, r=b-c] with b ≥ 200:

• The capacity is fixed to 160 bits: this implies a security level of 2⁸⁰ against generic collision search.
• The width b of Keccak-f[b] is in {200, 400, 800, 1600}: the width values that support the chosen capacity.
• The number of rounds n_r ranges from 1 to 12.

For each of these Keccak instances there are two challenges, so 96 in total:

• generating a collision in the output truncated to 160 bits;
• generating a pre-image of an output truncated to 80 bits.

To be informed of solutions, we suggest all interested people to subscribe to our mailing list by sending an empty mail to crunchy-subscribe -at- noekeon -dot- org. Solutions shall be sent to the mailing list crunchy -at- noekeon -dot- org before March 21, 2012 at 23:59 GMT+1, with:

• subject "[CRUNCHY CONTEST] n_r rounds, width b, challenge type", with n_r and b having the corresponding values and challenge type either "collision" or "pre-image";
• in the body:
• names and affiliations of authors;
• colliding messages or pre-image in hexadecimal notation;
• textual summary of how the result was obtained.

The prize money is distributed in the following way:

• For a given challenge, only the first solution received receives a prize.
• There are 24 prizes in total: one per number of rounds n_r and challenge type. In other words, the challenges are partitioned in groups of four, each time covering the four width values 200, 400, 800 and 1600.
• The prizes range from 10 € for a single round to 120 € for twelve rounds: the formula is n_r × 10 €.
• Within a group of challenges, the prize is distributed over the solutions received:
• 1^st solution: full prize if only one was received, and prize divided by 2 otherwise;
• 2^nd solution: prize divided by 2 if only two were received, and divided by 4 otherwise;
• 3^rd solution: prize divided by 4 if only three were received, and divided by 8 otherwise;
• 4^th solution: prize divided by 8.

We plan to hand out the prizes during the 3^rd SHA-3 candidate conference that will be held in Washington D.C., USA on March 22 and 23, 2012. For submitters that are not present, we will come up with a way for transferring the prizes.

We have released KeccakTools v3.1, which contains support for the validation of solutions (see file KeccakCrunchyContest.cpp).

Challenges and status

We list below the challenges and the status per number of rounds

Unless otherwise specified, the contents and files within the domain keccak.noekeon.org are © 2008-2011 Guido Bertoni, Joan Daemen, Michaël Peeters and Gilles Van Assche.

Last updated: 2011-11-28