I was studying the cryptographic "evolution" of IOTA from Curl to Troika and I noticed something in Kerl hash function.

Kerl is an adaptation of Keccak384 which works with trits but it introduces some big changes. In particular a major difference can be found in the squeezing phase. Here is the pseudocode for it:

def squeeze(length): if length not a multiple of 243: throw "Illegal length" while has trits to fill: bytes = self.k.digest() trits.copy(convertToTrits(bytes)) #offset in used as in Curl trits[242] = 0 #avoid conversion undefined edge-case self.k.reset() # [1] for byte in bytes: byte = ~byte #flip bits self.k.update(bytes)

  • Why is the sponge reset after each block is squeezed?
  • Why are the bytes flipped each time?

The only place in which more than a block is squeezed is the private key generation.

  • How does this changes affect the relation between the key segments?
  • Is there an increased correlation? Shouldn't this be a problem?

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.