I was studying the cryptographic "evolution" of IOTA from Curl to Troika and I noticed something in Kerl hash function.
Kerl is an adaptation of Keccak384 which works with trits but it introduces some big changes. In particular a major difference can be found in the squeezing phase. Here is the pseudocode for it:
if length not a multiple of 243: throw "Illegal length"
while has trits to fill:
bytes = self.k.digest()
trits.copy(convertToTrits(bytes)) #offset in used as in Curl
trits = 0 #avoid conversion undefined edge-case
self.k.reset() # 
for byte in bytes:
byte = ~byte #flip bits
- Why is the sponge reset after each block is squeezed?
- Why are the bytes flipped each time?
The only place in which more than a block is squeezed is the private key generation.
- How does this changes affect the relation between the key segments?
- Is there an increased correlation? Shouldn't this be a problem?