Sponge function

In cryptography, a sponge function or sponge construction is a class of algorithms with finite internal state that take an input bit stream of any length and produce an output bit stream of any desired length. Sponge functions have both theoretical and practical uses. They can be used to model or implement many cryptographic primitives, including cryptographic hashes, message authentication codes, mask generation functions, stream ciphers, pseudo-random number generators and authenticated encryption.

A sponge function is built from three components:

The state memory is divided into two sections: one of size r (the bitrate) and the other of size c (the capacity). These sections are denoted R and C respectively.

The padding function appends enough bits to the input string so that the length of the padded input is a whole multiple of the bitrate, r. The padded input can thus be broken into r-bit blocks.

The sponge function operates as follows:

The process is repeated until all the blocks of the padded input string are used up ("absorbed" in the sponge metaphor).

The sponge function output is now ready to be produced ("squeezed out") as follows:

The process is repeated until the desired number of output bits are produced. If the output length is not a multiple of r bits, it will be truncated.

Another metaphor describes the state memory as an "entropy pool", with input "poured into" the pool, and the transformation function referred to as "stirring the entropy pool".

Note that input bits are never XORed into the C portion of the state memory, nor are any bits of C ever output directly. The extent to which C is altered by the input depends entirely on the transformation function f. In hash applications, resistance to collision or preimage attacks depends on C, and its size, the "capacity" c, is typically twice the desired resistance level.

...
Wikipedia