]> Radboud University

Toernooiveld 212 Nijmegen The Netherlands b.viguier@cs.ru.nl

Internet Research Task Force (IRTF) Keccak Sakura KangarooTwelve Cryptographic Hash eXtendable Output Function This document defines the KangarooTwelve eXtendable Output Function (XOF), a hash function with arbitrary output length. It provides an efficient and secure hashing primitive, which is able to exploit the parallelism of the implementation in a scalable way. It uses tree hashing over a round-reduced version of SHAKE128 as underlying primitive. This document builds up on the definitions of the permutations and of the sponge construction in [FIPS 202], and is meant to serve as a stable reference and an implementation guide.

This document defines the KangarooTwelve eXtendable Output Function (XOF) , i.e. a generalization of a hash function that can return arbitrary output length. KangarooTwelve is based on a Keccak-p permutation specified in and aims at higher speed than SHAKE and SHA-3. The SHA-3 functions process data in a serial manner and unable to optimally exploit parallelism available in modern CPU architectures. KangarooTwelve splits the input message in fragments and applies an inner hash function F on each of them separately. It then applies F again on the concatenation of the digests. It makes use of Sakura coding for ensuring soundness of the tree hashing mode . The inner hash function F is a sponge function and uses a round-reduced version of the permutation used in Keccak. Its security builds up on the scrutiny that Keccak has received since its publication .

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119 . The following notations are used throughout the document: denotes a bit-string. For example, `1010101`. A 8 bit string `b_0 b_1 b_2 b_3 b_4 b_5 b_6 b_7` is a byte represented by an integer value v following the LSB 0 convention, i.e.

For example, `11100000` = 7. The following diagram represents the byte "07" with value 7 (decimal).

denotes a string of bytes given in hexadecimal. For example, "0B 80", which can be also be seen as a bit-string : `11010000 00000001`. denotes the length of a byte string "s". For example, |"FF FF"| = 2. denotes the repetition of bit `0` b times. For example, `0^4` = `0000`. denotes the empty bit-string. denotes the repetition of bit `1` b times. For example, `1^3` = `111`. denotes the b times the repetition of byte "00". For example, "00^7" = "00 00 00 00 00 00 00". denotes the concatenation of two strings 'a' and 'b'. For example, `10`||`01` = `1001` denotes the selection of bytes from n to m exclusive of a string 's'. For example, for s = "A5 C6 D7", s[0:1] = "A5" and s[1:3] = "C6 D7".

KangarooTwelve is an eXtendable Output Function (XOF). It takes as an input a pair of byte-strings (M, C) and a positive integer L where byte-string, is the Message and byte-string, is a Customization string and positive integer, the length of the output in bytes. The Customization string serves as domain separation. It is typically a short string such as a name or an identifier (e.g. URI, ODI...)

The inner function F makes use of the permutation Keccak-p[1600,n_r=12], i.e., a version of the one used in SHAKE and SHA-3 instances reduced to n_r=12 rounds and specified in FIPS 202 . F is a sponge function calling this permutation, multi-rate padding pad10*1 and with a rate of 168 bytes (= 1344 bits):

It follows that F has a capacity of 1600 - 1344 = 256 bits. The sponge function F takes as an input a bit-string S and a positive integer L where bit-string, is the input String and positive integer, the Length of the output in bytes The input string S SHOULD be represented as a pair (Sbytes, dS), where Sbytes contains only bytes and where dS is the delimited suffix representing the trailing bits. First, let S = Sbytes || Sbits, where Sbytes contains only bytes and Sbits contains at most 7 bits. Then, convert Sbits into the delimited suffix dS by appending a bit `1` and as many bits `0` as necessary so that dS is a byte. The numerical value of dS is thus:

Notice that the most significant bit `1` of dS coincides with the first bit of padding in the multi-rate padding rule pad10*1. The implementation of F therefore SHOULD add dS to the state and then the second bit of padding. provides a pseudo code version. In the table below, here are some examples of values, including those that are used in this document:

On top of the sponge function F, KangarooTwelve uses a Sakura-compatible tree hash mode . First, merge M and C to a single input string S in a reversible way. right_encode( |C| ) gives the length in bytes of C as a byte-string. See .

Then, split S into n chunks of 8192 bytes.

From S_1 .. S_n-1, compute the 32-bytes hashes CV_0 .. CV_n-2. This computation SHOULD exploit the parallelism available on the platform in order to be optimally efficient.

Compute the final node: Node*. If |S| <= 8192 bytes, then Node* = S || `11` Otherwise compute Node* as follow:

Finally, KangarooTwelve output is retrieved from F( Node* ).

For |S| > 8192 bytes, KangarooTwelve computation flow is as follow:

| CV_0 | +-------------------+ +--------------+ || +-------------------+ F +--------------+ | S_2 || `110` |------>| CV_1 | +-------------------+ +--------------+ || ... ... || +-------------------+ F +--------------+ | S_n-1 || `110` |------>| CV_n-2 | +-------------------+ +--------------+ || +--------------+ | r_e(n-1) | +--------------+ || +------------------+ F | "FF FF" || `01` |----------> output +------------------+ ]]>

We provide a pseudo code version in .

The function right_encode takes as inputs a non negative integer x < 256^255 and outputs a string of bytes x_n || .. || x_0 || n where

A pseudo code version is as follow.

0 S = x % 256 || S x = x / 256 S = S || length(S) return S end]]>

Test vectors are based on the repetition of pattern the "00 01 .. FA" with a specific length. ptn(n) defines a string by repeating the pattern "00 01 .. FA" as many times as necessary and truncated to n bytes e.g.

None.

This document is meant to serve as a stable reference and an implementation guide for the KangarooTwelve eXtendable Output Function. It makes no assertion to its security and relies on the cryptanalysis of Keccak .

&rfc2119; National Institute of Standards and Technology Keccak Team

The sub-sections of this appendix contain pseudo code definitions of KangarooTwelve.

> 7)* "71")) % 256 if (R & 2) lanes[0][0] = lanes[0][0] ^ (1 << ((1<

where ROL64(x, y) is a rotation of the 'x' 64-bit word toward the bits with higher indexes by 'y' bits.

0 blockSize = min(outputByteLen, 168) outputBytes = outputBytes || state[0:blockSize] outputByteLen = outputByteLen - blockSize if outputByteLen > 0 state = Keccak-p_1600_12(state) return outputBytes end]]>