International Association for Cryptologic Research

International Association
for Cryptologic Research


Paper: Tight Preimage Resistance of the Sponge Construction

Charlotte Lefevre , Radboud University
Bart Mennink , Radboud University
Search ePrint
Search Google
Conference: CRYPTO 2022
Abstract: The cryptographic sponge is a popular method for hash function design. The construction is in the ideal permutation model proven to be indifferentiable from a random oracle up to the birthday bound in the capacity of the sponge. This result in particular implies that, as long as the attack complexity does not exceed this bound, the sponge construction achieves a comparable level of collision, preimage, and second preimage resistance as a random oracle. We investigate these state-of-the-art bounds in detail, and observe that while the collision and second preimage security bounds are tight, the preimage bounds not tight. We derive an improved and tight preimage security bound for the cryptographic sponge construction. The result has direct implications for various lightweight cryptographic hash functions. For example, the NIST Lightweight Cryptography finalist Ascon-Hash does not generically achieve $2^{128}$ preimage security as claimed, but even $2^{192}$ preimage security. Comparable improvements are obtained for the modes of Spongent, PHOTON, ACE, Subterranean 2.0, and QUARK, among others.
Video from CRYPTO 2022
  title={Tight Preimage Resistance of the Sponge Construction},
  author={Charlotte Lefevre and Bart Mennink},